[Autofill] Don't hold onto stale form field pointers

components/autofill/content/renderer/form_cache.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/form_cache.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/autofill/content/renderer/form_autofill_util.h"
@@ skipping 63 matching lines @@
 
 FormCache::~FormCache() {
 }
 
 std::vector<FormData> FormCache::ExtractNewForms() {
   std::vector<FormData> forms;
   WebDocument document = frame_.document();
   if (document.isNull())
     return forms;
 
+  initial_checked_state_.clear();
+  initial_select_values_.clear();
   WebVector<WebFormElement> web_forms;
   document.forms(web_forms);
 
   // Log an error message for deprecated attributes, but only the first time
   // the form is parsed.
   bool log_deprecation_messages = parsed_forms_.empty();
 
   const ExtractMask extract_mask =
       static_cast<ExtractMask>(EXTRACT_VALUE | EXTRACT_OPTIONS);
 
@@ skipping 14 matching lines @@
                                   extract_mask, &form, nullptr)) {
       continue;
     }
 
     num_fields_seen += form.fields.size();
     if (num_fields_seen > kMaxParseableFields)
       return forms;
 
     if (form.fields.size() >= kRequiredAutofillFields &&
         !ContainsKey(parsed_forms_, form)) {
+      for (auto it = parsed_forms_.begin(); it != parsed_forms_.end(); ++it) {
+        if (it->SameFormAs(form)) {
+          parsed_forms_.erase(it);
+          break;
+        }
+      }
+
+      SaveInitialValues(control_elements);
       forms.push_back(form);
       parsed_forms_.insert(form);
     }
   }
 
   // Look for more parseable fields outside of forms.
   std::vector<WebElement> fieldsets;
   std::vector<WebFormControlElement> control_elements =
       GetUnownedAutofillableFormFieldElements(document.all(), &fieldsets);
 
   size_t num_editable_elements =
       ScanFormControlElements(control_elements, log_deprecation_messages);
 
   if (ShouldIgnoreForm(num_editable_elements, control_elements.size()))
     return forms;
 
   FormData synthetic_form;
   if (!UnownedFormElementsAndFieldSetsToFormData(
           fieldsets, control_elements, nullptr, document, extract_mask,
           &synthetic_form, nullptr)) {
     return forms;
   }
 
   num_fields_seen += synthetic_form.fields.size();
   if (num_fields_seen > kMaxParseableFields)
     return forms;
 
   if (synthetic_form.fields.size() >= kRequiredAutofillFields &&
       !parsed_forms_.count(synthetic_form)) {
+    SaveInitialValues(control_elements);
     forms.push_back(synthetic_form);
     parsed_forms_.insert(synthetic_form);
+    parsed_forms_.erase(synthetic_form_);
     synthetic_form_ = synthetic_form;
   }
   return forms;
 }
 
 void FormCache::Reset() {
   synthetic_form_ = FormData();
   parsed_forms_.clear();
   initial_select_values_.clear();
   initial_checked_state_.clear();
@@ skipping 133 matching lines @@
     bool log_deprecation_messages) {
   size_t num_editable_elements = 0;
   for (size_t i = 0; i < control_elements.size(); ++i) {
     const WebFormControlElement& element = control_elements[i];
 
     if (log_deprecation_messages)
       LogDeprecationMessages(element);
 
     // Save original values of <select> elements so we can restore them
     // when |ClearFormWithNode()| is invoked.
+    if (IsSelectElement(element) || IsTextAreaElement(element)) {
+      ++num_editable_elements;
+    } else {
+      const WebInputElement input_element = element.toConst<WebInputElement>();
+      if (!IsCheckableElement(&input_element))
+        ++num_editable_elements;
+    }
+  }
+  return num_editable_elements;
+}
+
+void FormCache::SaveInitialValues(
+    const std::vector<WebFormControlElement>& control_elements) {
+  for (const WebFormControlElement& element : control_elements) {
     if (IsSelectElement(element)) {
       const WebSelectElement select_element =
           element.toConst<WebSelectElement>();
       initial_select_values_.insert(
           std::make_pair(select_element, select_element.value()));
-      ++num_editable_elements;
-    } else if (IsTextAreaElement(element)) {
-      ++num_editable_elements;
     } else {
-      const WebInputElement input_element =
-          element.toConst<WebInputElement>();
-      if (IsCheckableElement(&input_element)) {
+      const WebInputElement* input_element = toWebInputElement(&element);
+      if (IsCheckableElement(input_element)) {
         initial_checked_state_.insert(
-            std::make_pair(input_element, input_element.isChecked()));
-      } else {
-        ++num_editable_elements;
+            std::make_pair(*input_element, input_element->isChecked()));
       }
     }
   }
-  return num_editable_elements;
 }
 
 }  // namespace autofill