submit() in submit event handler should not contains a value of a submit button.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 217 matching lines @@
             }
             if (fromImplicitSubmissionTrigger) {
                 // Default (submit) button is not activated; no implicit submission.
                 return;
             }
         } else if (control->canTriggerImplicitSubmission()) {
             ++submissionTriggerCount;
         }
     }
     if (fromImplicitSubmissionTrigger && submissionTriggerCount == 1)
-        prepareForSubmission(event);
-}
-
-// FIXME: Consolidate this and similar code in FormSubmission.cpp.
-static inline HTMLFormControlElement* submitElementFromEvent(const Event* event)
-{
-    for (Node* node = event->target()->toNode(); node; node = node->parentOrShadowHostNode()) {
-        if (node->isElementNode() && toElement(node)->isFormControlElement())
-            return toHTMLFormControlElement(node);
-    }
-    return 0;
+        prepareForSubmission(event, nullptr);
 }
 
 bool HTMLFormElement::validateInteractively()
 {
     UseCounter::count(document(), UseCounter::FormValidationStarted);
     const FormAssociatedElement::List& elements = associatedElements();
     for (unsigned i = 0; i < elements.size(); ++i) {
         if (elements[i]->isFormControlElement())
             toHTMLFormControlElement(elements[i])->hideVisibleValidationMessage();
     }
@@ skipping 25 matching lines @@
             if (unhandled->isFocusable())
                 continue;
             String message("An invalid form control with name='%name' is not focusable.");
             message.replace("%name", unhandled->name());
             document().addConsoleMessage(ConsoleMessage::create(RenderingMessageSource, ErrorMessageLevel, message));
         }
     }
     return false;
 }
 
-void HTMLFormElement::prepareForSubmission(Event* event)
+void HTMLFormElement::prepareForSubmission(Event* event, HTMLFormControlElement* submitButton)
 {
     LocalFrame* frame = document().frame();
     if (!frame || m_isSubmitting || m_inUserJSSubmitEvent)
         return;
 
     if (document().isSandboxed(SandboxForms)) {
         document().addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Blocked form submission to '" + m_attributes.action() + "' because the form's frame is sandboxed and the 'allow-forms' permission is not set."));
         return;
     }
 
     bool skipValidation = !document().page() || noValidate();
     DCHECK(event);
-    HTMLFormControlElement* submitElement = submitElementFromEvent(event);
-    if (submitElement && submitElement->formNoValidate())
+    if (submitButton && submitButton->formNoValidate())
         skipValidation = true;
 
     UseCounter::count(document(), UseCounter::FormSubmissionStarted);
     // Interactive validation must be done before dispatching the submit event.
     if (!skipValidation && !validateInteractively())
         return;
 
     bool shouldSubmit;
     {
         AutoReset<bool> submitEventHandlerScope(&m_inUserJSSubmitEvent, true);
         frame->loader().client()->dispatchWillSendSubmitEvent(this);
         shouldSubmit = dispatchEvent(Event::createCancelableBubble(EventTypeNames::submit)) == DispatchEventResult::NotCanceled;
     }
     if (shouldSubmit) {
         m_plannedNavigation = nullptr;
-        submit(event, true);
+        submit(event, submitButton);
     }
     if (!m_plannedNavigation)
         return;
     AutoReset<bool> submitScope(&m_isSubmitting, true);
     scheduleFormSubmission(m_plannedNavigation);
     m_plannedNavigation = nullptr;
 }
 
 void HTMLFormElement::submitFromJavaScript()
 {
-    submit(0, false);
+    submit(nullptr, nullptr);
 }
 
 void HTMLFormElement::submitDialog(FormSubmission* formSubmission)
 {
     for (Node* node = this; node; node = node->parentOrShadowHostNode()) {
         if (isHTMLDialogElement(*node)) {
             toHTMLDialogElement(*node).closeDialog(formSubmission->result());
             return;
         }
     }
 }
 
-void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
+void HTMLFormElement::submit(Event* event, HTMLFormControlElement* submitButton)
 {
     FrameView* view = document().view();
     LocalFrame* frame = document().frame();
     if (!view || !frame || !frame->page())
         return;
 
     // https://html.spec.whatwg.org/multipage/forms.html#form-submission-algorithm
     // 2. If form document is not connected, has no associated browsing context,
     // or its active sandboxing flag set has its sandboxed forms browsing
     // context flag set, then abort these steps without doing anything.
     if (!isConnected())
         return;
 
     if (m_isSubmitting)
         return;
 
     // Delay dispatching 'close' to dialog until done submitting.
     EventQueueScope scopeForDialogClose;
     AutoReset<bool> submitScope(&m_isSubmitting, true);
 
-    HTMLFormControlElement* firstSuccessfulSubmitButton = nullptr;
-    bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
-
-    const FormAssociatedElement::List& elements = associatedElements();
-    for (unsigned i = 0; i < elements.size(); ++i) {
-        FormAssociatedElement* associatedElement = elements[i];
-        if (!associatedElement->isFormControlElement())
-            continue;
-        if (needButtonActivation) {
+    if (event && !submitButton) {
+        // In a case of implicit submission without a submit button, 'submit'
+        // event handler might add a submit button. We search for a submit
+        // button again.
+        // TODO(tkent): Do we really need to activate such submit button?
+        for (const auto& associatedElement : associatedElements()) {
+            if (!associatedElement->isFormControlElement())
+                continue;
             HTMLFormControlElement* control = toHTMLFormControlElement(associatedElement);
-            if (control->isActivatedSubmit())
-                needButtonActivation = false;
-            else if (firstSuccessfulSubmitButton == 0 && control->isSuccessfulSubmitButton())
-                firstSuccessfulSubmitButton = control;
+            DCHECK(!control->isActivatedSubmit());
+            if (control->isSuccessfulSubmitButton()) {
+                submitButton = control;
+                break;
+            }
         }
     }
 
-    if (needButtonActivation && firstSuccessfulSubmitButton)
-        firstSuccessfulSubmitButton->setActivatedSubmit(true);
-
-    FormSubmission* formSubmission = FormSubmission::create(this, m_attributes, event);
+    FormSubmission* formSubmission = FormSubmission::create(this, m_attributes, event, submitButton);
     if (formSubmission->method() == FormSubmission::DialogMethod) {
         submitDialog(formSubmission);
     } else if (m_inUserJSSubmitEvent) {
         // Need to postpone the submission in order to make this cancelable by
         // another submission request.
         m_plannedNavigation = formSubmission;
     } else {
         // This runs JavaScript code if action attribute value is javascript:
         // protocol.
         scheduleFormSubmission(formSubmission);
     }
-
-    if (needButtonActivation && firstSuccessfulSubmitButton)
-        firstSuccessfulSubmitButton->setActivatedSubmit(false);
 }
 
 void HTMLFormElement::scheduleFormSubmission(FormSubmission* submission)
 {
     DCHECK(submission->method() == FormSubmission::PostMethod || submission->method() == FormSubmission::GetMethod);
     DCHECK(submission->data());
     DCHECK(submission->form());
     if (submission->action().isEmpty())
         return;
     if (document().isSandboxed(SandboxForms)) {
@@ skipping 386 matching lines @@
 {
     for (const auto& control : associatedElements()) {
         if (!control->isFormControlElement())
             continue;
         if (toHTMLFormControlElement(control)->canBeSuccessfulSubmitButton())
             toHTMLFormControlElement(control)->pseudoStateChanged(CSSSelector::PseudoDefault);
     }
 }
 
 } // namespace blink