Autofill select field text should be captured not selection option value

chrome/renderer/form_manager.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/form_manager.h"
 
 #include "base/logging.h"
 #include "base/scoped_vector.h"
 #include "base/string_util.h"
 #include "base/stl_util-inl.h"
@@ skipping 312 matching lines @@
       element.formControlType() == WebString::fromUTF8("hidden")) {
     const WebInputElement& input_element =
         element.toConst<WebInputElement>();
     value = input_element.value();
   } else if (element.formControlType() == WebString::fromUTF8("select-one")) {
     // TODO(jhawkins): This is ugly.  WebSelectElement::value() is a non-const
     // method.  Look into fixing this on the WebKit side.
     WebFormControlElement& e = const_cast<WebFormControlElement&>(element);
     WebSelectElement select_element = e.to<WebSelectElement>();
     value = select_element.value();
+
+    // Convert the |select_element| value to text if requested.
+    if (extract_mask & EXTRACT_TEXT) {
+      WebVector<WebElement> list_items = select_element.listItems();
+      for (size_t i = 0; i < list_items.size(); ++i) {
+        if (list_items[i].hasTagName("option") &&
+            list_items[i].to<WebOptionElement>().value() == value) {
+          value = list_items[i].to<WebOptionElement>().text();

[James Hawkins, 2010/11/16 18:03:12]

This overwrites the value of the selected option, are we sure this isn't going
to break auto-filling select controls? The API for setting the value of a select
control requires the actual value to be sent in, not the text. Our code to
convert CA <-> California may help us here, but I'm not sure.

[dhollowa, 2010/11/16 19:25:57]

Yes, I verified this case.  We only send the |text| value on form submission. 
So there is no interaction with filling or suggestions.

+          break;
+        }
+      }
+    }
   }
 
   // TODO(jhawkins): This is a temporary stop-gap measure designed to prevent
   // a malicious site from DOS'ing the browser with extremely large profile
   // data.  The correct solution is to parse this data asynchronously.
   // See http://crbug.com/49332.
   if (value.size() > kMaxDataLength)
     value = value.substr(0, kMaxDataLength);
 
   field->set_value(value);
@@ skipping 553 matching lines @@
   WebInputElement input_element = field->to<WebInputElement>();
 
   // If the maxlength attribute contains a negative value, maxLength()
   // returns the default maxlength value.
   input_element.setSuggestedValue(
       data->value().substr(0, input_element.maxLength()));
   input_element.setAutofilled(true);
   if (is_initiating_node)
     input_element.setSelectionRange(0, input_element.suggestedValue().length());
 }