Don't delay submit in onsubmit event handler

Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 285 matching lines @@
     if (!validateInteractively(event)) {
         m_isSubmittingOrPreparingForSubmission = false;
         return false;
     }
 
     StringPairVector controlNamesAndValues;
     getTextFieldValues(controlNamesAndValues);
     RefPtr<FormState> formState = FormState::create(this, controlNamesAndValues, &document(), NotSubmittedByJavaScript);
     frame->loader().client()->dispatchWillSendSubmitEvent(formState.release());
 
-    if (dispatchEvent(Event::createCancelableBubble(EventTypeNames::submit)))
-        m_shouldSubmit = true;
-
+    // Set flag before submission as dispatchEvent could trigger another event
     m_isSubmittingOrPreparingForSubmission = false;
 
-    if (m_shouldSubmit)
+    // http://www.whatwg.org/specs/web-apps/current-work/#concept-form-submit
+    // Submit Event can be cancelled i.e. returned false or can explicitly declare default prevented
+    // http://www.w3.org/TR/DOM-Level-3-Events/#event-flow-default-cancel.
+    // Returning false is also considered as default prevented.
+    if (!dispatchEvent(Event::createCancelableBubble(EventTypeNames::submit))
+        || event->defaultPrevented()) {

[keishi, 2014/02/25 15:00:57]

I think prepareForSubmission is always called from defaultEventHandler() so
event->defaultPrevented() should always be false. Maybe this should be an
ASSERT.

+        return m_shouldSubmit; // i.e. do not proceed
+    }
+    if (!m_shouldSubmit) {
+        m_shouldSubmit = true;
         submit(event, true, true, NotSubmittedByJavaScript);
+    }
 
     return m_shouldSubmit;
 }
 
 void HTMLFormElement::submit()
 {
     submit(0, false, true, NotSubmittedByJavaScript);
 }
 
 void HTMLFormElement::submitFromJavaScript()
@@ skipping 28 matching lines @@
             toHTMLDialogElement(node)->closeDialog(formSubmission->result());
             return;
         }
     }
 }
 
 void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool processingUserGesture, FormSubmissionTrigger formSubmissionTrigger)
 {
     FrameView* view = document().view();
     Frame* frame = document().frame();
-    if (!view || !frame || !frame->page())
+    if (!view || !frame || !frame->page() || m_isSubmittingOrPreparingForSubmission)
         return;
 
-    if (m_isSubmittingOrPreparingForSubmission) {
-        m_shouldSubmit = true;
-        return;
-    }
-
     m_isSubmittingOrPreparingForSubmission = true;
     m_wasUserSubmitted = processingUserGesture;
 
     RefPtr<HTMLFormControlElement> firstSuccessfulSubmitButton;
     bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
 
     const Vector<FormAssociatedElement*>& elements = associatedElements();
     for (unsigned i = 0; i < elements.size(); ++i) {
         FormAssociatedElement* associatedElement = elements[i];
         if (!associatedElement->isFormControlElement())
@@ skipping 438 matching lines @@
 }
 
 void HTMLFormElement::setDemoted(bool demoted)
 {
     if (demoted)
         UseCounter::count(document(), UseCounter::DemotedFormElement);
     m_wasDemoted = demoted;
 }
 
 } // namespace