Basic autofill into password value on user gesture only.

components/autofill/content/renderer/password_autofill_agent.cc

Index: components/autofill/content/renderer/password_autofill_agent.cc
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 034ec424e217c1eef3224a1517f957713f62cebd..02770f56bf1a750b2e38522881e75a62750f75ee 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -189,10 +189,15 @@ PasswordAutofillAgent::PasswordAutofillAgent(content::RenderView* render_view)
     : content::RenderViewObserver(render_view),
       usernames_usage_(NOTHING_TO_AUTOFILL),
       web_view_(render_view->GetWebView()),
+      gesture_handler_(new AutofillWebUserGestureHandler(this)),
+      user_gesture_occurred_(false),
       weak_ptr_factory_(this) {
+  blink::WebUserGestureIndicator::setHandler(gesture_handler_.get());
 }
 
 PasswordAutofillAgent::~PasswordAutofillAgent() {
+  DCHECK(gesture_handler_.get());
+  blink::WebUserGestureIndicator::setHandler(NULL);
 }
 
 bool PasswordAutofillAgent::TextFieldDidEndEditing(
@@ -492,6 +497,11 @@ void PasswordAutofillAgent::DidStartProvisionalLoad(blink::WebFrame* frame) {
     }
     // Clear the whole map during main frame navigation.
     provisionally_saved_forms_.clear();
+
+    // We are navigating, se we need to wait for a new user gesture before
+    // filling in passwords.
+    user_gesture_occurred_ = false;
+    gesture_handler_->clearElements();
   }
 }
 
@@ -728,7 +738,16 @@ bool PasswordAutofillAgent::FillUserNameAndPassword(
     return false;
   }
 
-  password_element->setValue(password);
+  // If a user gesture has not occurred, we setup a handler to listen for the
+  // next user gesture, at which point we then fill in the password. This is to
+  // make sure that we do not fill in the DOM with a password until we believe
+  // the user is intentionally interacting with the page.
+  if (!user_gesture_occurred_) {
+    gesture_handler_->addElement(*password_element);
+    password_element->setSuggestedValue(password);
+  } else {
+    password_element->setValue(password);
+  }
   SetElementAutofilled(password_element, true);
   return true;
 }
@@ -801,4 +820,23 @@ bool PasswordAutofillAgent::FindLoginInfo(const blink::WebNode& node,
   return true;
 }
 
+void PasswordAutofillAgent::AutofillWebUserGestureHandler::onGesture() {
+  agent_->set_user_gesture_occurred(true);
+
+  std::vector<blink::WebInputElement>::iterator iter;
+  for (iter = elements_.begin(); iter != elements_.end(); ++iter) {
+    if (!iter->isNull() && !iter->suggestedValue().isNull())
+      iter->setValue(iter->suggestedValue());
+  }
+
+  elements_.clear();
+}
+
+PasswordAutofillAgent::AutofillWebUserGestureHandler::
+    AutofillWebUserGestureHandler(PasswordAutofillAgent* agent)
+    : agent_(agent) {}
+
+PasswordAutofillAgent::AutofillWebUserGestureHandler::
+    ~AutofillWebUserGestureHandler() {}
+
 }  // namespace autofill