[Autofill] Don't hold onto stale form field pointers

components/autofill/content/renderer/form_cache.cc

Index: components/autofill/content/renderer/form_cache.cc
diff --git a/components/autofill/content/renderer/form_cache.cc b/components/autofill/content/renderer/form_cache.cc
index c1a41a8cd82c0e9fdb59eb53f3c6ff0a8c88f9e1..1436200a46bce76f69e291b0c34f87f846894dc8 100644
--- a/components/autofill/content/renderer/form_cache.cc
+++ b/components/autofill/content/renderer/form_cache.cc
@@ -81,6 +81,8 @@ std::vector<FormData> FormCache::ExtractNewForms() {
   if (document.isNull())
     return forms;
 
+  initial_checked_state_.clear();
+  initial_select_values_.clear();
   WebVector<WebFormElement> web_forms;
   document.forms(web_forms);
 
@@ -115,6 +117,14 @@ std::vector<FormData> FormCache::ExtractNewForms() {
 
     if (form.fields.size() >= kRequiredAutofillFields &&
         !ContainsKey(parsed_forms_, form)) {
+      for (auto it = parsed_forms_.begin(); it != parsed_forms_.end(); ++it) {
+        if (it->SameFormAs(form)) {
+          parsed_forms_.erase(it);
+          break;
+        }
+      }
+
+      SaveInitialValues(control_elements);
       forms.push_back(form);
       parsed_forms_.insert(form);
     }
@@ -144,8 +154,10 @@ std::vector<FormData> FormCache::ExtractNewForms() {
 
   if (synthetic_form.fields.size() >= kRequiredAutofillFields &&
       !parsed_forms_.count(synthetic_form)) {
+    SaveInitialValues(control_elements);
     forms.push_back(synthetic_form);
     parsed_forms_.insert(synthetic_form);
+    parsed_forms_.erase(synthetic_form_);
     synthetic_form_ = synthetic_form;
   }
   return forms;
@@ -299,26 +311,34 @@ size_t FormCache::ScanFormControlElements(
 
     // Save original values of <select> elements so we can restore them
     // when |ClearFormWithNode()| is invoked.
+    if (IsSelectElement(element) || IsTextAreaElement(element)) {
+      ++num_editable_elements;
+    } else {
+      const WebInputElement input_element = element.toConst<WebInputElement>();
+      if (!IsCheckableElement(&input_element))
+        ++num_editable_elements;
+    }
+  }
+  return num_editable_elements;
+}
+
+void FormCache::SaveInitialValues(
+    const std::vector<WebFormControlElement>& control_elements) {
+  for (size_t i = 0; i < control_elements.size(); ++i) {
+    const WebFormControlElement& element = control_elements[i];

[Lei Zhang, 2015/06/05 03:45:35]

for (const WebFOrmControlElement& element : control_elements)

[Evan Stade, 2015/06/05 22:16:43]

Done.

     if (IsSelectElement(element)) {
       const WebSelectElement select_element =
           element.toConst<WebSelectElement>();
       initial_select_values_.insert(
           std::make_pair(select_element, select_element.value()));
-      ++num_editable_elements;
-    } else if (IsTextAreaElement(element)) {
-      ++num_editable_elements;
     } else {
-      const WebInputElement input_element =
-          element.toConst<WebInputElement>();
+      const WebInputElement input_element = element.toConst<WebInputElement>();

[Lei Zhang, 2015/06/05 03:45:35]

The 3 subclasses of WebFormControlElement are WebSelectElement, WebInputElement,
and WebTextAreaElement. With the refactoring here, this is no longer
guaranteeded to be a WebInputElement.

[Evan Stade, 2015/06/05 22:16:43]

fixed, I guess

       if (IsCheckableElement(&input_element)) {
         initial_checked_state_.insert(
             std::make_pair(input_element, input_element.isChecked()));
-      } else {
-        ++num_editable_elements;
       }
     }
   }
-  return num_editable_elements;
 }
 
 }  // namespace autofill