Destroy (Password)AutofillAgent safely

components/autofill/content/renderer/form_autofill_util.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/form_autofill_util.h"
 
 #include <map>
 #include <set>
 
 #include "base/command_line.h"
@@ skipping 874 matching lines @@
   if (IsCheckableElement(input_element)) {
     input_element->setChecked(data.is_checked, true);
   } else {
     base::string16 value = data.value;
     if (IsTextInput(input_element) || IsMonthInput(input_element)) {
       // If the maxlength attribute contains a negative value, maxLength()
       // returns the default maxlength value.
       TruncateString(&value, input_element->maxLength());
     }
     field->setValue(value, true);
+    // Setting the value might trigger JavaScript, which is capable of
+    // destroying the frame.
+    if (!field->document().frame())
+      return;

[robwu, 2016/05/04 14:35:38]

Are you sure that |field| is still valid?
One of the new test cases from https://crbug.com/608101#c6 shows this stack:
https://bugs.chromium.org/p/chromium/issues/attachmentText?aid=233641.

Although I only reported about setValue, setChecked (a few lines back) should
also be fixed. Similarly for FormCache::ClearFormWithElement.

[vabr (Chromium), 2016/05/04 14:49:46]

It's refcounted and a reference is held by the caller, so it should be.
Good point, added.
While it does hold a reference to a frame without adding to its refcount, I
don't see it using it after setting any values. At that point it is the
responsibility of the caller to avoid calling it again once the frame is
deleted.

   }
 
   field->setAutofilled(true);
 
   if (is_initiating_node &&
       ((IsTextInput(input_element) || IsMonthInput(input_element)) ||
        IsTextAreaElement(*field))) {
     int length = field->value().length();
     field->setSelectionRange(length, length);
     // Clear the current IME composition (the underline), if there is one.
@@ skipping 858 matching lines @@
     // Zero selection start is for password manager, which can show usernames
     // that do not begin with the user input value.
     selection_start = (offset == base::string16::npos) ? 0 : offset;
   }
 
   input_element->setSelectionRange(selection_start, suggestion.length());
 }
 
 }  // namespace form_util
 }  // namespace autofill