Fix check for user gesture on password autofill

content/renderer/render_widget.cc

Index: content/renderer/render_widget.cc
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 3dddbf49bbdeea814ee87e1a12051473b80610d0..74c7beaa67e9d1902cf24c4328aa94f6144cb57b 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -1088,6 +1088,9 @@ void RenderWidget::OnHandleInputEvent(const blink::WebInputEvent* input_event,
           base::HistogramBase::kUmaTargetedHistogramFlag);
   counter_for_type->Add(delta);
 
+  if (WebInputEvent::isUserGestureEventType(input_event->type))

[jamesr, 2014/02/19 20:00:07]

TouchStart is considered a user gesture, so if a user touches their devices
screen in any way during load this will fire and autofill will kick in.  I
really don't see how this provides any useful indication of user intent.  Have
you never tried to scroll a page before it's fully loaded?

[jww, 2014/02/19 22:04:48]

As mentioned in the comments, this is meant to be a mitigation for a very, very
specific use case, namely rapid redirects of sites with an XSS to collect
autofilled credentials. The user intent is meant to be as simple as "I am
interacting with this navigation."

Now, if an attacker wants to attack a user more precisely, this is certainly not
a good mitigation. Ultimately, if the attacker has an XSS to a site that the
user uses, the attacker will be able to obtain the credentials. It's more
widespread harvesting that we're concerned about here.

+    NotifyAboutUserGesture();
+
   bool prevent_default = false;
   if (WebInputEvent::isMouseEventType(input_event->type)) {
     const WebMouseEvent& mouse_event =