PasswordManager fills up text input field with password, or PM crashes chrome tab/window/session

chrome/renderer/password_autocomplete_manager.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/password_autocomplete_manager.h"
 
 #include "base/message_loop.h"
 #include "base/scoped_ptr.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/renderer/render_view.h"
@@ skipping 35 matching lines @@
 // in |data|, and add results to |result|.
 static bool FindFormInputElements(WebKit::WebFormElement* fe,
                                   const webkit_glue::FormData& data,
                                   FormElements* result) {
   // Loop through the list of elements we need to find on the form in order to
   // autocomplete it. If we don't find any one of them, abort processing this
   // form; it can't be the right one.
   for (size_t j = 0; j < data.fields.size(); j++) {
     WebKit::WebVector<WebKit::WebNode> temp_elements;
     fe->getNamedElements(data.fields[j].name(), temp_elements);
-    if (temp_elements.isEmpty()) {
-      // We didn't find a required element. This is not the right form.
-      // Make sure no input elements from a partially matched form in this
-      // iteration remain in the result set.
-      // Note: clear will remove a reference from each InputElement.
+
+    // Match the first input element, if any.
+    // |getNamedElements| may return non-input elements where the names match,
+    // so the results are filtered for input elements.
+    // If more than one match is made, then we have ambiguity (due to misuse
+    // of "name" attribute) so is it considered not found.
+    bool found_input = false;
+    for (size_t i = 0; i < temp_elements.size(); ++i) {
+      if (temp_elements[i].to<WebKit::WebElement>().hasTagName("input")) {
+        // Check for a non-unique match.
+        if (found_input) {
+          found_input = false;
+          break;
+        }
+
+        // This element matched, add it to our temporary result. It's possible
+        // there are multiple matches, but for purposes of identifying the form
+        // one suffices and if some function needs to deal with multiple
+        // matching elements it can get at them through the FormElement*.
+        // Note: This assignment adds a reference to the InputElement.
+        result->input_elements[data.fields[j].name()] =
+            temp_elements[i].to<WebKit::WebInputElement>();
+        found_input = true;
+      }
+    }
+
+    // A required element was not found. This is not the right form.
+    // Make sure no input elements from a partially matched form in this
+    // iteration remain in the result set.
+    // Note: clear will remove a reference from each InputElement.
+    if (!found_input) {
       result->input_elements.clear();
       return false;
     }
-    // This element matched, add it to our temporary result. It's possible there
-    // are multiple matches, but for purposes of identifying the form one
-    // suffices and if some function needs to deal with multiple matching
-    // elements it can get at them through the FormElement*.
-    // Note: This assignment adds a reference to the InputElement.
-    result->input_elements[data.fields[j].name()] =
-        temp_elements[0].to<WebKit::WebInputElement>();
   }
   return true;
 }
 
 // Helper to locate form elements identified by |data|.
 void FindFormElements(WebKit::WebView* view,
                       const webkit_glue::FormData& data,
                       FormElementsList* results) {
   DCHECK(view);
   DCHECK(results);
@@ skipping 40 matching lines @@
 bool FillForm(FormElements* fe, const webkit_glue::FormData& data) {
   if (!fe->form_element.autoComplete())
     return false;
 
   std::map<string16, string16> data_map;
   for (size_t i = 0; i < data.fields.size(); i++)
     data_map[data.fields[i].name()] = data.fields[i].value();
 
   for (FormInputElementMap::iterator it = fe->input_elements.begin();
        it != fe->input_elements.end(); ++it) {
-    WebKit::WebInputElement& element = it->second;
+    WebKit::WebInputElement element = it->second;
     if (!element.value().isEmpty())  // Don't overwrite pre-filled values.
       continue;
     if (element.isPasswordField() &&
         (!element.isEnabledFormControl() || element.hasAttribute("readonly"))) {
       continue;  // Don't fill uneditable password fields.
     }
     // TODO(tkent): Check maxlength and pattern.
     element.setValue(data_map[it->first]);
     element.setAutofilled(true);
     element.dispatchFormControlChangeEvent();
@@ skipping 348 matching lines @@
     username_element->setSelectionRange(current_username.length(),
                                         username.length());
   }
 
   SetElementAutofilled(username_element, true);
   if (IsElementEditable(*password_element))
     password_element->setValue(password);
   SetElementAutofilled(password_element, true);
   return true;
 }