dom/html/HTMLFormElement.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "mozilla/dom/HTMLFormElement.h"
   8
   9 #include <utility>
  10
  11 #include "Attr.h"
  12 #include "jsapi.h"
  13 #include "mozilla/AutoRestore.h"
  14 #include "mozilla/BasePrincipal.h"
  15 #include "mozilla/BinarySearch.h"
  16 #include "mozilla/Components.h"
  17 #include "mozilla/ContentEvents.h"
  18 #include "mozilla/EventDispatcher.h"
  19 #include "mozilla/PresShell.h"
  20 #include "mozilla/UniquePtr.h"
  21 #include "mozilla/dom/BindContext.h"
  22 #include "mozilla/dom/BrowsingContext.h"
  23 #include "mozilla/dom/CustomEvent.h"
  24 #include "mozilla/dom/Document.h"
  25 #include "mozilla/dom/HTMLFormControlsCollection.h"
  26 #include "mozilla/dom/HTMLFormElementBinding.h"
  27 #include "mozilla/dom/TreeOrderedArrayInlines.h"
  28 #include "mozilla/dom/nsCSPContext.h"
  29 #include "mozilla/dom/nsCSPUtils.h"
  30 #include "mozilla/dom/nsMixedContentBlocker.h"
  31 #include "nsCOMArray.h"
  32 #include "nsContentList.h"
  33 #include "nsContentUtils.h"
  34 #include "nsDOMAttributeMap.h"
  35 #include "nsDocShell.h"
  36 #include "nsDocShellLoadState.h"
  37 #include "nsError.h"
  38 #include "nsFocusManager.h"
  39 #include "nsGkAtoms.h"
  40 #include "nsHTMLDocument.h"
  41 #include "nsIFormControlFrame.h"
  42 #include "nsInterfaceHashtable.h"
  43 #include "nsPresContext.h"
  44 #include "nsQueryObject.h"
  45 #include "nsStyleConsts.h"
  46 #include "nsTArray.h"
  47
  48 // form submission
  49 #include "HTMLFormSubmissionConstants.h"
  50 #include "mozilla/dom/FormData.h"
  51 #include "mozilla/dom/FormDataEvent.h"
  52 #include "mozilla/dom/SubmitEvent.h"
  53 #include "mozilla/Telemetry.h"
  54 #include "mozilla/StaticPrefs_dom.h"
  55 #include "mozilla/StaticPrefs_prompts.h"
  56 #include "nsCategoryManagerUtils.h"
  57 #include "nsIContentInlines.h"
  58 #include "nsISimpleEnumerator.h"
  59 #include "nsRange.h"
  60 #include "nsIScriptError.h"
  61 #include "nsIScriptSecurityManager.h"
  62 #include "nsNetUtil.h"
  63 #include "nsIInterfaceRequestorUtils.h"
  64 #include "nsIDocShell.h"
  65 #include "nsIPromptService.h"
  66 #include "nsISecurityUITelemetry.h"
  67 #include "nsIStringBundle.h"
  68
  69 // radio buttons
  70 #include "mozilla/dom/HTMLInputElement.h"
  71 #include "mozilla/dom/HTMLButtonElement.h"
  72 #include "mozilla/dom/HTMLSelectElement.h"
  73 #include "nsIRadioVisitor.h"
  74 #include "RadioNodeList.h"
  75
  76 #include "nsLayoutUtils.h"
  77
  78 #include "mozAutoDocUpdate.h"
  79 #include "nsIHTMLCollection.h"
  80
  81 #include "nsIConstraintValidation.h"
  82
  83 #include "nsSandboxFlags.h"
  84
  85 #include "mozilla/dom/HTMLAnchorElement.h"
  86
  87 // images
  88 #include "mozilla/dom/HTMLImageElement.h"
  89 #include "mozilla/dom/HTMLButtonElement.h"
  90
  91 // construction, destruction
  92 NS_IMPL_NS_NEW_HTML_ELEMENT(Form)
  93
  94 namespace mozilla::dom {
  95
  96 static const uint8_t NS_FORM_AUTOCOMPLETE_ON = 1;
  97 static const uint8_t NS_FORM_AUTOCOMPLETE_OFF = 0;
  98
  99 static const nsAttrValue::EnumTable kFormAutocompleteTable[] = {
 100     {"on", NS_FORM_AUTOCOMPLETE_ON},
 101     {"off", NS_FORM_AUTOCOMPLETE_OFF},
 102     {nullptr, 0}};
 103 // Default autocomplete value is 'on'.
 104 static const nsAttrValue::EnumTable* kFormDefaultAutocomplete =
 105     &kFormAutocompleteTable[0];
 106
 107 HTMLFormElement::HTMLFormElement(
 108     already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
 109     : nsGenericHTMLElement(std::move(aNodeInfo)),
 110       mControls(new HTMLFormControlsCollection(this)),
 111       mPendingSubmission(nullptr),
 112       mDefaultSubmitElement(nullptr),
 113       mFirstSubmitInElements(nullptr),
 114       mFirstSubmitNotInElements(nullptr),
 115       mImageNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
 116       mPastNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
 117       mSubmitPopupState(PopupBlocker::openAbused),
 118       mInvalidElementsCount(0),
 119       mFormNumber(-1),
 120       mGeneratingSubmit(false),
 121       mGeneratingReset(false),
 122       mDeferSubmission(false),
 123       mNotifiedObservers(false),
 124       mNotifiedObserversResult(false),
 125       mIsConstructingEntryList(false),
 126       mIsFiringSubmissionEvents(false) {
 127   // We start out valid.
 128   AddStatesSilently(ElementState::VALID);
 129 }
 130
 131 HTMLFormElement::~HTMLFormElement() {
 132   if (mControls) {
 133     mControls->DropFormReference();
 134   }
 135
 136   Clear();
 137 }
 138
 139 // nsISupports
 140
 141 NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLFormElement)
 142
 143 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLFormElement,
 144                                                   nsGenericHTMLElement)
 145   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControls)
 146   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mImageNameLookupTable)
 147   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPastNameLookupTable)
 148   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRelList)
 149   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTargetContext)
 150 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 151
 152 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLFormElement,
 153                                                 nsGenericHTMLElement)
 154   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRelList)
 155   NS_IMPL_CYCLE_COLLECTION_UNLINK(mTargetContext)
 156   tmp->Clear();
 157   tmp->mExpandoAndGeneration.OwnerUnlinked();
 158 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 159
 160 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED_0(HTMLFormElement,
 161                                                nsGenericHTMLElement)
 162
 163 // EventTarget
 164 void HTMLFormElement::AsyncEventRunning(AsyncEventDispatcher* aEvent) {
 165   if (aEvent->mEventType == u"DOMFormHasPassword"_ns) {
 166     mHasPendingPasswordEvent = false;
 167   } else if (aEvent->mEventType == u"DOMFormHasPossibleUsername"_ns) {
 168     mHasPendingPossibleUsernameEvent = false;
 169   }
 170 }
 171
 172 nsDOMTokenList* HTMLFormElement::RelList() {
 173   if (!mRelList) {
 174     mRelList =
 175         new nsDOMTokenList(this, nsGkAtoms::rel, sAnchorAndFormRelValues);
 176   }
 177   return mRelList;
 178 }
 179
 180 NS_IMPL_ELEMENT_CLONE(HTMLFormElement)
 181
 182 HTMLFormControlsCollection* HTMLFormElement::Elements() { return mControls; }
 183
 184 void HTMLFormElement::BeforeSetAttr(int32_t aNamespaceID, nsAtom* aName,
 185                                     const nsAttrValue* aValue, bool aNotify) {
 186   if (aNamespaceID == kNameSpaceID_None) {
 187     if (aName == nsGkAtoms::action || aName == nsGkAtoms::target) {
 188       // Don't forget we've notified the password manager already if the
 189       // page sets the action/target in the during submit. (bug 343182)
 190       bool notifiedObservers = mNotifiedObservers;
 191       ForgetCurrentSubmission();
 192       mNotifiedObservers = notifiedObservers;
 193     }
 194   }
 195
 196   return nsGenericHTMLElement::BeforeSetAttr(aNamespaceID, aName, aValue,
 197                                              aNotify);
 198 }
 199
 200 void HTMLFormElement::GetAutocomplete(nsAString& aValue) {
 201   GetEnumAttr(nsGkAtoms::autocomplete, kFormDefaultAutocomplete->tag, aValue);
 202 }
 203
 204 void HTMLFormElement::GetEnctype(nsAString& aValue) {
 205   GetEnumAttr(nsGkAtoms::enctype, kFormDefaultEnctype->tag, aValue);
 206 }
 207
 208 void HTMLFormElement::GetMethod(nsAString& aValue) {
 209   GetEnumAttr(nsGkAtoms::method, kFormDefaultMethod->tag, aValue);
 210 }
 211
 212 void HTMLFormElement::ReportInvalidUnfocusableElements(
 213     const nsTArray<RefPtr<Element>>&& aInvalidElements) {
 214   RefPtr<nsFocusManager> focusManager = nsFocusManager::GetFocusManager();
 215   MOZ_ASSERT(focusManager);
 216
 217   for (const auto& element : aInvalidElements) {
 218     bool isFocusable = false;
 219     // MOZ_KnownLive because 'aInvalidElements' is guaranteed to keep it alive.
 220     // This can go away once bug 1620312 is fixed.
 221     focusManager->ElementIsFocusable(MOZ_KnownLive(element), 0, &isFocusable);
 222     if (!isFocusable) {
 223       nsTArray<nsString> params;
 224       nsAutoCString messageName("InvalidFormControlUnfocusable");
 225
 226       if (Attr* nameAttr = element->GetAttributes()->GetNamedItem(u"name"_ns)) {
 227         nsAutoString name;
 228         nameAttr->GetValue(name);
 229         params.AppendElement(name);
 230         messageName = "InvalidNamedFormControlUnfocusable";
 231       }
 232
 233       nsContentUtils::ReportToConsole(
 234           nsIScriptError::errorFlag, "DOM"_ns, element->GetOwnerDocument(),
 235           nsContentUtils::eDOM_PROPERTIES, messageName.get(), params,
 236           element->GetBaseURI());
 237     }
 238   }
 239 }
 240
 241 // https://html.spec.whatwg.org/multipage/forms.html#concept-form-submit
 242 void HTMLFormElement::MaybeSubmit(Element* aSubmitter) {
 243 #ifdef DEBUG
 244   if (aSubmitter) {
 245     nsCOMPtr<nsIFormControl> fc = do_QueryInterface(aSubmitter);
 246     MOZ_ASSERT(fc);
 247     MOZ_ASSERT(fc->IsSubmitControl(), "aSubmitter is not a submit control?");
 248   }
 249 #endif
 250
 251   // 1-4 of
 252   // https://html.spec.whatwg.org/multipage/forms.html#concept-form-submit
 253   Document* doc = GetComposedDoc();
 254   if (mIsConstructingEntryList || !doc ||
 255       (doc->GetSandboxFlags() & SANDBOXED_FORMS)) {
 256     return;
 257   }
 258
 259   // 5.1. If form's firing submission events is true, then return.
 260   if (mIsFiringSubmissionEvents) {
 261     return;
 262   }
 263
 264   // 5.2. Set form's firing submission events to true.
 265   AutoRestore<bool> resetFiringSubmissionEventsFlag(mIsFiringSubmissionEvents);
 266   mIsFiringSubmissionEvents = true;
 267
 268   // Flag elements as user-interacted.
 269   // FIXME: Should be specified, see:
 270   // https://github.com/whatwg/html/issues/10066
 271   {
 272     for (nsGenericHTMLFormElement* el : mControls->mElements.AsList()) {
 273       el->SetUserInteracted(true);
 274     }
 275     for (nsGenericHTMLFormElement* el : mControls->mNotInElements.AsList()) {
 276       el->SetUserInteracted(true);
 277     }
 278   }
 279
 280   // 5.3. If the submitter element's no-validate state is false, then
 281   //      interactively validate the constraints of form and examine the result.
 282   //      If the result is negative (i.e., the constraint validation concluded
 283   //      that there were invalid fields and probably informed the user of this)
 284   bool noValidateState =
 285       HasAttr(nsGkAtoms::novalidate) ||
 286       (aSubmitter && aSubmitter->HasAttr(nsGkAtoms::formnovalidate));
 287   if (!noValidateState && !CheckValidFormSubmission()) {
 288     return;
 289   }
 290
 291   RefPtr<PresShell> presShell = doc->GetPresShell();
 292   if (!presShell) {
 293     // We need the nsPresContext for dispatching the submit event. In some
 294     // rare cases we need to flush notifications to force creation of the
 295     // nsPresContext here (for example when a script calls form.requestSubmit()
 296     // from script early during page load). We only flush the notifications
 297     // if the PresShell hasn't been created yet, to limit the performance
 298     // impact.
 299     doc->FlushPendingNotifications(FlushType::EnsurePresShellInitAndFrames);
 300     presShell = doc->GetPresShell();
 301   }
 302
 303   // If |PresShell::Destroy| has been called due to handling the event the pres
 304   // context will return a null pres shell. See bug 125624. Using presShell to
 305   // dispatch the event. It makes sure that event is not handled if the window
 306   // is being destroyed.
 307   if (presShell) {
 308     SubmitEventInit init;
 309     init.mBubbles = true;
 310     init.mCancelable = true;
 311     init.mSubmitter =
 312         aSubmitter ? nsGenericHTMLElement::FromNode(aSubmitter) : nullptr;
 313     RefPtr<SubmitEvent> event =
 314         SubmitEvent::Constructor(this, u"submit"_ns, init);
 315     event->SetTrusted(true);
 316     nsEventStatus status = nsEventStatus_eIgnore;
 317     presShell->HandleDOMEventWithTarget(this, event, &status);
 318   }
 319 }
 320
 321 void HTMLFormElement::MaybeReset(Element* aSubmitter) {
 322   // If |PresShell::Destroy| has been called due to handling the event the pres
 323   // context will return a null pres shell. See bug 125624. Using presShell to
 324   // dispatch the event. It makes sure that event is not handled if the window
 325   // is being destroyed.
 326   if (RefPtr<PresShell> presShell = OwnerDoc()->GetPresShell()) {
 327     InternalFormEvent event(true, eFormReset);
 328     event.mOriginator = aSubmitter;
 329     nsEventStatus status = nsEventStatus_eIgnore;
 330     presShell->HandleDOMEventWithTarget(this, &event, &status);
 331   }
 332 }
 333
 334 void HTMLFormElement::Submit(ErrorResult& aRv) { aRv = DoSubmit(); }
 335
 336 // https://html.spec.whatwg.org/multipage/forms.html#dom-form-requestsubmit
 337 void HTMLFormElement::RequestSubmit(nsGenericHTMLElement* aSubmitter,
 338                                     ErrorResult& aRv) {
 339   // 1. If submitter is not null, then:
 340   if (aSubmitter) {
 341     nsCOMPtr<nsIFormControl> fc = do_QueryObject(aSubmitter);
 342
 343     // 1.1. If submitter is not a submit button, then throw a TypeError.
 344     if (!fc || !fc->IsSubmitControl()) {
 345       aRv.ThrowTypeError("The submitter is not a submit button.");
 346       return;
 347     }
 348
 349     // 1.2. If submitter's form owner is not this form element, then throw a
 350     //      "NotFoundError" DOMException.
 351     if (fc->GetForm() != this) {
 352       aRv.ThrowNotFoundError("The submitter is not owned by this form.");
 353       return;
 354     }
 355   }
 356
 357   // 2. Otherwise, set submitter to this form element.
 358   // 3. Submit this form element, from submitter.
 359   MaybeSubmit(aSubmitter);
 360 }
 361
 362 void HTMLFormElement::Reset() {
 363   InternalFormEvent event(true, eFormReset);
 364   EventDispatcher::Dispatch(this, nullptr, &event);
 365 }
 366
 367 bool HTMLFormElement::ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
 368                                      const nsAString& aValue,
 369                                      nsIPrincipal* aMaybeScriptedPrincipal,
 370                                      nsAttrValue& aResult) {
 371   if (aNamespaceID == kNameSpaceID_None) {
 372     if (aAttribute == nsGkAtoms::method) {
 373       return aResult.ParseEnumValue(aValue, kFormMethodTable, false);
 374     }
 375     if (aAttribute == nsGkAtoms::enctype) {
 376       return aResult.ParseEnumValue(aValue, kFormEnctypeTable, false);
 377     }
 378     if (aAttribute == nsGkAtoms::autocomplete) {
 379       return aResult.ParseEnumValue(aValue, kFormAutocompleteTable, false);
 380     }
 381   }
 382
 383   return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
 384                                               aMaybeScriptedPrincipal, aResult);
 385 }
 386
 387 nsresult HTMLFormElement::BindToTree(BindContext& aContext, nsINode& aParent) {
 388   nsresult rv = nsGenericHTMLElement::BindToTree(aContext, aParent);
 389   NS_ENSURE_SUCCESS(rv, rv);
 390
 391   if (IsInUncomposedDoc() && aContext.OwnerDoc().IsHTMLOrXHTML()) {
 392     aContext.OwnerDoc().AsHTMLDocument()->AddedForm();
 393   }
 394
 395   return rv;
 396 }
 397
 398 template <typename T>
 399 static void MarkOrphans(const nsTArray<T*>& aArray) {
 400   uint32_t length = aArray.Length();
 401   for (uint32_t i = 0; i < length; ++i) {
 402     aArray[i]->SetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
 403   }
 404 }
 405
 406 static void CollectOrphans(nsINode* aRemovalRoot,
 407                            const nsTArray<nsGenericHTMLFormElement*>& aArray
 408 #ifdef DEBUG
 409                            ,
 410                            HTMLFormElement* aThisForm
 411 #endif
 412 ) {
 413   // Put a script blocker around all the notifications we're about to do.
 414   nsAutoScriptBlocker scriptBlocker;
 415
 416   // Walk backwards so that if we remove elements we can just keep iterating
 417   uint32_t length = aArray.Length();
 418   for (uint32_t i = length; i > 0; --i) {
 419     nsGenericHTMLFormElement* node = aArray[i - 1];
 420
 421     // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
 422     // node is in fact a descendant of the form and hence should stay in the
 423     // form.  If it _is_ set, then we need to check whether the node is a
 424     // descendant of aRemovalRoot.  If it is, we leave it in the form.
 425 #ifdef DEBUG
 426     bool removed = false;
 427 #endif
 428     if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) {
 429       node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
 430       if (!node->IsInclusiveDescendantOf(aRemovalRoot)) {
 431         nsCOMPtr<nsIFormControl> fc = do_QueryInterface(node);
 432         MOZ_ASSERT(fc);
 433         fc->ClearForm(true, false);
 434 #ifdef DEBUG
 435         removed = true;
 436 #endif
 437       }
 438     }
 439
 440 #ifdef DEBUG
 441     if (!removed) {
 442       nsCOMPtr<nsIFormControl> fc = do_QueryInterface(node);
 443       MOZ_ASSERT(fc);
 444       HTMLFormElement* form = fc->GetForm();
 445       NS_ASSERTION(form == aThisForm, "How did that happen?");
 446     }
 447 #endif /* DEBUG */
 448   }
 449 }
 450
 451 static void CollectOrphans(nsINode* aRemovalRoot,
 452                            const nsTArray<HTMLImageElement*>& aArray
 453 #ifdef DEBUG
 454                            ,
 455                            HTMLFormElement* aThisForm
 456 #endif
 457 ) {
 458   // Walk backwards so that if we remove elements we can just keep iterating
 459   uint32_t length = aArray.Length();
 460   for (uint32_t i = length; i > 0; --i) {
 461     HTMLImageElement* node = aArray[i - 1];
 462
 463     // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
 464     // node is in fact a descendant of the form and hence should stay in the
 465     // form.  If it _is_ set, then we need to check whether the node is a
 466     // descendant of aRemovalRoot.  If it is, we leave it in the form.
 467 #ifdef DEBUG
 468     bool removed = false;
 469 #endif
 470     if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) {
 471       node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
 472       if (!node->IsInclusiveDescendantOf(aRemovalRoot)) {
 473         node->ClearForm(true);
 474
 475 #ifdef DEBUG
 476         removed = true;
 477 #endif
 478       }
 479     }
 480
 481 #ifdef DEBUG
 482     if (!removed) {
 483       HTMLFormElement* form = node->GetForm();
 484       NS_ASSERTION(form == aThisForm, "How did that happen?");
 485     }
 486 #endif /* DEBUG */
 487   }
 488 }
 489
 490 void HTMLFormElement::UnbindFromTree(UnbindContext& aContext) {
 491   MaybeFireFormRemoved();
 492
 493   // Note, this is explicitly using uncomposed doc, since we count
 494   // only forms in document.
 495   RefPtr<Document> oldDocument = GetUncomposedDoc();
 496
 497   // Mark all of our controls as maybe being orphans
 498   MarkOrphans(mControls->mElements.AsList());
 499   MarkOrphans(mControls->mNotInElements.AsList());
 500   MarkOrphans(mImageElements.AsList());
 501
 502   nsGenericHTMLElement::UnbindFromTree(aContext);
 503
 504   nsINode* ancestor = this;
 505   nsINode* cur;
 506   do {
 507     cur = ancestor->GetParentNode();
 508     if (!cur) {
 509       break;
 510     }
 511     ancestor = cur;
 512   } while (true);
 513
 514   CollectOrphans(ancestor, mControls->mElements
 515 #ifdef DEBUG
 516                  ,
 517                  this
 518 #endif
 519   );
 520   CollectOrphans(ancestor, mControls->mNotInElements
 521 #ifdef DEBUG
 522                  ,
 523                  this
 524 #endif
 525   );
 526   CollectOrphans(ancestor, mImageElements
 527 #ifdef DEBUG
 528                  ,
 529                  this
 530 #endif
 531   );
 532
 533   if (oldDocument && oldDocument->IsHTMLOrXHTML()) {
 534     oldDocument->AsHTMLDocument()->RemovedForm();
 535   }
 536   ForgetCurrentSubmission();
 537 }
 538
 539 static bool CanSubmit(WidgetEvent& aEvent) {
 540   // According to the UI events spec section "Trusted events", we shouldn't
 541   // trigger UA default action with an untrusted event except click.
 542   // However, there are still some sites depending on sending untrusted event
 543   // to submit form, see Bug 1370630.
 544   return !StaticPrefs::dom_forms_submit_trusted_event_only() ||
 545          aEvent.IsTrusted();
 546 }
 547
 548 void HTMLFormElement::GetEventTargetParent(EventChainPreVisitor& aVisitor) {
 549   aVisitor.mWantsWillHandleEvent = true;
 550   if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this) &&
 551       CanSubmit(*aVisitor.mEvent)) {
 552     uint32_t msg = aVisitor.mEvent->mMessage;
 553     if (msg == eFormSubmit) {
 554       if (mGeneratingSubmit) {
 555         aVisitor.mCanHandle = false;
 556         return;
 557       }
 558       mGeneratingSubmit = true;
 559
 560       // XXXedgar, the untrusted event would trigger form submission, in this
 561       // case, form need to handle defer flag and flushing pending submission by
 562       // itself. This could be removed after Bug 1370630.
 563       if (!aVisitor.mEvent->IsTrusted()) {
 564         // let the form know that it needs to defer the submission,
 565         // that means that if there are scripted submissions, the
 566         // latest one will be deferred until after the exit point of the
 567         // handler.
 568         mDeferSubmission = true;
 569       }
 570     } else if (msg == eFormReset) {
 571       if (mGeneratingReset) {
 572         aVisitor.mCanHandle = false;
 573         return;
 574       }
 575       mGeneratingReset = true;
 576     }
 577   }
 578   nsGenericHTMLElement::GetEventTargetParent(aVisitor);
 579 }
 580
 581 void HTMLFormElement::WillHandleEvent(EventChainPostVisitor& aVisitor) {
 582   // If this is the bubble stage and there is a nested form below us which
 583   // received a submit event we do *not* want to handle the submit event
 584   // for this form too.
 585   if ((aVisitor.mEvent->mMessage == eFormSubmit ||
 586        aVisitor.mEvent->mMessage == eFormReset) &&
 587       aVisitor.mEvent->mFlags.mInBubblingPhase &&
 588       aVisitor.mEvent->mOriginalTarget != static_cast<nsIContent*>(this)) {
 589     aVisitor.mEvent->StopPropagation();
 590   }
 591 }
 592
 593 nsresult HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor) {
 594   if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this) &&
 595       CanSubmit(*aVisitor.mEvent)) {
 596     EventMessage msg = aVisitor.mEvent->mMessage;
 597     if (aVisitor.mEventStatus == nsEventStatus_eIgnore) {
 598       switch (msg) {
 599         case eFormReset: {
 600           DoReset();
 601           break;
 602         }
 603         case eFormSubmit: {
 604           if (!aVisitor.mEvent->IsTrusted()) {
 605             // Warning about the form submission is from untrusted event.
 606             OwnerDoc()->WarnOnceAbout(
 607                 DeprecatedOperations::eFormSubmissionUntrustedEvent);
 608           }
 609           RefPtr<Event> event = aVisitor.mDOMEvent;
 610           DoSubmit(event);
 611           break;
 612         }
 613         default:
 614           break;
 615       }
 616     }
 617
 618     // XXXedgar, the untrusted event would trigger form submission, in this
 619     // case, form need to handle defer flag and flushing pending submission by
 620     // itself. This could be removed after Bug 1370630.
 621     if (msg == eFormSubmit && !aVisitor.mEvent->IsTrusted()) {
 622       // let the form know not to defer subsequent submissions
 623       mDeferSubmission = false;
 624       // tell the form to flush a possible pending submission.
 625       FlushPendingSubmission();
 626     }
 627
 628     if (msg == eFormSubmit) {
 629       mGeneratingSubmit = false;
 630     } else if (msg == eFormReset) {
 631       mGeneratingReset = false;
 632     }
 633   }
 634   return NS_OK;
 635 }
 636
 637 nsresult HTMLFormElement::DoReset() {
 638   // Make sure the presentation is up-to-date
 639   Document* doc = GetComposedDoc();
 640   if (doc) {
 641     doc->FlushPendingNotifications(FlushType::ContentAndNotify);
 642   }
 643
 644   // JBK walk the elements[] array instead of form frame controls - bug 34297
 645   uint32_t numElements = mControls->Length();
 646   for (uint32_t elementX = 0; elementX < numElements; ++elementX) {
 647     // Hold strong ref in case the reset does something weird
 648     nsCOMPtr<nsIFormControl> controlNode = do_QueryInterface(
 649         mControls->mElements->SafeElementAt(elementX, nullptr));
 650     if (controlNode) {
 651       controlNode->Reset();
 652     }
 653   }
 654
 655   return NS_OK;
 656 }
 657
 658 #define NS_ENSURE_SUBMIT_SUCCESS(rv) \
 659   if (NS_FAILED(rv)) {               \
 660     ForgetCurrentSubmission();       \
 661     return rv;                       \
 662   }
 663
 664 nsresult HTMLFormElement::DoSubmit(Event* aEvent) {
 665   Document* doc = GetComposedDoc();
 666   NS_ASSERTION(doc, "Should never get here without a current doc");
 667
 668   // Make sure the presentation is up-to-date
 669   if (doc) {
 670     doc->FlushPendingNotifications(FlushType::ContentAndNotify);
 671   }
 672
 673   // Don't submit if we're not in a document or if we're in
 674   // a sandboxed frame and form submit is disabled.
 675   if (mIsConstructingEntryList || !doc ||
 676       (doc->GetSandboxFlags() & SANDBOXED_FORMS)) {
 677     return NS_OK;
 678   }
 679
 680   if (IsSubmitting()) {
 681     NS_WARNING("Preventing double form submission");
 682     // XXX Should this return an error?
 683     return NS_OK;
 684   }
 685
 686   mTargetContext = nullptr;
 687   mCurrentLoadId = Nothing();
 688
 689   UniquePtr<HTMLFormSubmission> submission;
 690
 691   //
 692   // prepare the submission object
 693   //
 694   nsresult rv = BuildSubmission(getter_Transfers(submission), aEvent);
 695
 696   // Don't raise an error if form cannot navigate.
 697   if (rv == NS_ERROR_NOT_AVAILABLE) {
 698     return NS_OK;
 699   }
 700
 701   NS_ENSURE_SUCCESS(rv, rv);
 702
 703   // XXXbz if the script global is that for an sXBL/XBL2 doc, it won't
 704   // be a window...
 705   nsPIDOMWindowOuter* window = OwnerDoc()->GetWindow();
 706   if (window) {
 707     mSubmitPopupState = PopupBlocker::GetPopupControlState();
 708   } else {
 709     mSubmitPopupState = PopupBlocker::openAbused;
 710   }
 711
 712   //
 713   // perform the submission
 714   //
 715   if (!submission) {
 716 #ifdef DEBUG
 717     HTMLDialogElement* dialog = nullptr;
 718     for (nsIContent* parent = GetParent(); parent;
 719          parent = parent->GetParent()) {
 720       dialog = HTMLDialogElement::FromNodeOrNull(parent);
 721       if (dialog) {
 722         break;
 723       }
 724     }
 725     MOZ_ASSERT(!dialog || !dialog->Open());
 726 #endif
 727     return NS_OK;
 728   }
 729
 730   if (DialogFormSubmission* dialogSubmission =
 731           submission->GetAsDialogSubmission()) {
 732     return SubmitDialog(dialogSubmission);
 733   }
 734
 735   if (mDeferSubmission) {
 736     // we are in an event handler, JS submitted so we have to
 737     // defer this submission. let's remember it and return
 738     // without submitting
 739     mPendingSubmission = std::move(submission);
 740     return NS_OK;
 741   }
 742
 743   return SubmitSubmission(submission.get());
 744 }
 745
 746 nsresult HTMLFormElement::BuildSubmission(HTMLFormSubmission** aFormSubmission,
 747                                           Event* aEvent) {
 748   // Get the submitter element
 749   nsGenericHTMLElement* submitter = nullptr;
 750   if (aEvent) {
 751     SubmitEvent* submitEvent = aEvent->AsSubmitEvent();
 752     if (submitEvent) {
 753       submitter = submitEvent->GetSubmitter();
 754     }
 755   }
 756
 757   nsresult rv;
 758
 759   //
 760   // Walk over the form elements and call SubmitNamesValues() on them to get
 761   // their data.
 762   //
 763   auto encoding = GetSubmitEncoding()->OutputEncoding();
 764   RefPtr<FormData> formData =
 765       new FormData(GetOwnerGlobal(), encoding, submitter);
 766   rv = ConstructEntryList(formData);
 767   NS_ENSURE_SUBMIT_SUCCESS(rv);
 768
 769   // Step 9. If form cannot navigate, then return.
 770   // https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#form-submission-algorithm
 771   if (!GetComposedDoc()) {
 772     return NS_ERROR_NOT_AVAILABLE;
 773   }
 774
 775   //
 776   // Get the submission object
 777   //
 778   rv = HTMLFormSubmission::GetFromForm(this, submitter, encoding,
 779                                        aFormSubmission);
 780   NS_ENSURE_SUBMIT_SUCCESS(rv);
 781
 782   //
 783   // Dump the data into the submission object
 784   //
 785   if (!(*aFormSubmission)->GetAsDialogSubmission()) {
 786     rv = formData->CopySubmissionDataTo(*aFormSubmission);
 787     NS_ENSURE_SUBMIT_SUCCESS(rv);
 788   }
 789
 790   return NS_OK;
 791 }
 792
 793 nsresult HTMLFormElement::SubmitSubmission(
 794     HTMLFormSubmission* aFormSubmission) {
 795   MOZ_ASSERT(!mDeferSubmission);
 796   MOZ_ASSERT(!mPendingSubmission);
 797
 798   nsCOMPtr<nsIURI> actionURI = aFormSubmission->GetActionURL();
 799   if (!actionURI) {
 800     return NS_OK;
 801   }
 802
 803   // If there is no link handler, then we won't actually be able to submit.
 804   Document* doc = GetComposedDoc();
 805   RefPtr<nsDocShell> container =
 806       doc ? nsDocShell::Cast(doc->GetDocShell()) : nullptr;
 807   if (!container || IsEditable()) {
 808     return NS_OK;
 809   }
 810
 811   // javascript URIs are not really submissions; they just call a function.
 812   // Also, they may synchronously call submit(), and we want them to be able to
 813   // do so while still disallowing other double submissions. (Bug 139798)
 814   // Note that any other URI types that are of equivalent type should also be
 815   // added here.
 816   // XXXbz this is a mess.  The real issue here is that nsJSChannel sets the
 817   // LOAD_BACKGROUND flag, so doesn't notify us, compounded by the fact that
 818   // the JS executes before we forget the submission in OnStateChange on
 819   // STATE_STOP.  As a result, we have to make sure that we simply pretend
 820   // we're not submitting when submitting to a JS URL.  That's kinda bogus, but
 821   // there we are.
 822   bool schemeIsJavaScript = actionURI->SchemeIs("javascript");
 823
 824   //
 825   // Notify observers of submit
 826   //
 827   nsresult rv;
 828   bool cancelSubmit = false;
 829   if (mNotifiedObservers) {
 830     cancelSubmit = mNotifiedObserversResult;
 831   } else {
 832     rv = NotifySubmitObservers(actionURI, &cancelSubmit, true);
 833     NS_ENSURE_SUBMIT_SUCCESS(rv);
 834   }
 835
 836   if (cancelSubmit) {
 837     return NS_OK;
 838   }
 839
 840   cancelSubmit = false;
 841   rv = NotifySubmitObservers(actionURI, &cancelSubmit, false);
 842   NS_ENSURE_SUBMIT_SUCCESS(rv);
 843
 844   if (cancelSubmit) {
 845     return NS_OK;
 846   }
 847
 848   //
 849   // Submit
 850   //
 851   uint64_t currentLoadId = 0;
 852
 853   {
 854     AutoPopupStatePusher popupStatePusher(mSubmitPopupState);
 855
 856     AutoHandlingUserInputStatePusher userInpStatePusher(
 857         aFormSubmission->IsInitiatedFromUserInput());
 858
 859     nsCOMPtr<nsIInputStream> postDataStream;
 860     rv = aFormSubmission->GetEncodedSubmission(
 861         actionURI, getter_AddRefs(postDataStream), actionURI);
 862     NS_ENSURE_SUBMIT_SUCCESS(rv);
 863
 864     nsAutoString target;
 865     aFormSubmission->GetTarget(target);
 866
 867     RefPtr<nsDocShellLoadState> loadState = new nsDocShellLoadState(actionURI);
 868     loadState->SetTarget(target);
 869     loadState->SetPostDataStream(postDataStream);
 870     loadState->SetFirstParty(true);
 871     loadState->SetIsFormSubmission(true);
 872     loadState->SetTriggeringPrincipal(NodePrincipal());
 873     loadState->SetPrincipalToInherit(NodePrincipal());
 874     loadState->SetCsp(GetCsp());
 875     loadState->SetAllowFocusMove(UserActivation::IsHandlingUserInput());
 876
 877     nsCOMPtr<nsIPrincipal> nodePrincipal = NodePrincipal();
 878     rv = container->OnLinkClickSync(this, loadState, false, nodePrincipal);
 879     NS_ENSURE_SUBMIT_SUCCESS(rv);
 880
 881     mTargetContext = loadState->TargetBrowsingContext().GetMaybeDiscarded();
 882     currentLoadId = loadState->GetLoadIdentifier();
 883   }
 884
 885   // Even if the submit succeeds, it's possible for there to be no
 886   // browsing context; for example, if it's to a named anchor within
 887   // the same page the submit will not really do anything.
 888   if (mTargetContext && !mTargetContext->IsDiscarded() && !schemeIsJavaScript) {
 889     mCurrentLoadId = Some(currentLoadId);
 890   } else {
 891     ForgetCurrentSubmission();
 892   }
 893
 894   return rv;
 895 }
 896
 897 // https://html.spec.whatwg.org/#concept-form-submit step 11
 898 nsresult HTMLFormElement::SubmitDialog(DialogFormSubmission* aFormSubmission) {
 899   // Close the dialog subject. If there is a result, let that be the return
 900   // value.
 901   HTMLDialogElement* dialog = aFormSubmission->DialogElement();
 902   MOZ_ASSERT(dialog);
 903
 904   Optional<nsAString> retValue;
 905   retValue = &aFormSubmission->ReturnValue();
 906   dialog->Close(retValue);
 907
 908   return NS_OK;
 909 }
 910
 911 nsresult HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI* aActionURL,
 912                                                         bool* aCancelSubmit) {
 913   *aCancelSubmit = false;
 914
 915   if (!StaticPrefs::security_warn_submit_secure_to_insecure()) {
 916     return NS_OK;
 917   }
 918
 919   // Only ask the user about posting from a secure URI to an insecure URI if
 920   // this element is in the root document. When this is not the case, the mixed
 921   // content blocker will take care of security for us.
 922   if (!OwnerDoc()->IsTopLevelContentDocument()) {
 923     return NS_OK;
 924   }
 925
 926   if (nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL(aActionURL)) {
 927     return NS_OK;
 928   }
 929
 930   if (nsMixedContentBlocker::URISafeToBeLoadedInSecureContext(aActionURL)) {
 931     return NS_OK;
 932   }
 933
 934   if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(aActionURL)) {
 935     return NS_OK;
 936   }
 937
 938   nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow();
 939   if (!window) {
 940     return NS_ERROR_FAILURE;
 941   }
 942
 943   // Now that we know the action URI is insecure check if we're submitting from
 944   // a secure URI and if so fall thru and prompt user about posting.
 945   if (nsCOMPtr<nsPIDOMWindowInner> innerWindow = OwnerDoc()->GetInnerWindow()) {
 946     if (!innerWindow->IsSecureContext()) {
 947       return NS_OK;
 948     }
 949   }
 950
 951   // Bug 1351358: While file URIs are considered to be secure contexts we allow
 952   // submitting a form to an insecure URI from a file URI without an alert in an
 953   // attempt to avoid compatibility issues.
 954   if (window->GetDocumentURI()->SchemeIs("file")) {
 955     return NS_OK;
 956   }
 957
 958   nsCOMPtr<nsIDocShell> docShell = window->GetDocShell();
 959   if (!docShell) {
 960     return NS_ERROR_FAILURE;
 961   }
 962
 963   nsresult rv;
 964   nsCOMPtr<nsIPromptService> promptSvc =
 965       do_GetService("@mozilla.org/prompter;1", &rv);
 966   if (NS_FAILED(rv)) {
 967     return rv;
 968   }
 969
 970   nsCOMPtr<nsIStringBundle> stringBundle;
 971   nsCOMPtr<nsIStringBundleService> stringBundleService =
 972       mozilla::components::StringBundle::Service();
 973   if (!stringBundleService) {
 974     return NS_ERROR_FAILURE;
 975   }
 976   rv = stringBundleService->CreateBundle(
 977       "chrome://global/locale/browser.properties",
 978       getter_AddRefs(stringBundle));
 979   if (NS_FAILED(rv)) {
 980     return rv;
 981   }
 982   nsAutoString title;
 983   nsAutoString message;
 984   nsAutoString cont;
 985   stringBundle->GetStringFromName("formPostSecureToInsecureWarning.title",
 986                                   title);
 987   stringBundle->GetStringFromName("formPostSecureToInsecureWarning.message",
 988                                   message);
 989   stringBundle->GetStringFromName("formPostSecureToInsecureWarning.continue",
 990                                   cont);
 991   int32_t buttonPressed;
 992   bool checkState =
 993       false;  // this is unused (ConfirmEx requires this parameter)
 994   rv = promptSvc->ConfirmExBC(
 995       docShell->GetBrowsingContext(),
 996       StaticPrefs::prompts_modalType_insecureFormSubmit(), title.get(),
 997       message.get(),
 998       (nsIPromptService::BUTTON_TITLE_IS_STRING *
 999        nsIPromptService::BUTTON_POS_0) +
1000           (nsIPromptService::BUTTON_TITLE_CANCEL *
1001            nsIPromptService::BUTTON_POS_1),
1002       cont.get(), nullptr, nullptr, nullptr, &checkState, &buttonPressed);
1003   if (NS_FAILED(rv)) {
1004     return rv;
1005   }
1006   *aCancelSubmit = (buttonPressed == 1);
1007   uint32_t telemetryBucket =
1008       nsISecurityUITelemetry::WARNING_CONFIRM_POST_TO_INSECURE_FROM_SECURE;
1009   mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI,
1010                                  telemetryBucket);
1011   if (!*aCancelSubmit) {
1012     // The user opted to continue, so note that in the next telemetry bucket.
1013     mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI,
1014                                    telemetryBucket + 1);
1015   }
1016   return NS_OK;
1017 }
1018
1019 nsresult HTMLFormElement::NotifySubmitObservers(nsIURI* aActionURL,
1020                                                 bool* aCancelSubmit,
1021                                                 bool aEarlyNotify) {
1022   if (!aEarlyNotify) {
1023     nsresult rv = DoSecureToInsecureSubmitCheck(aActionURL, aCancelSubmit);
1024     if (NS_FAILED(rv)) {
1025       return rv;
1026     }
1027     if (*aCancelSubmit) {
1028       return NS_OK;
1029     }
1030   }
1031
1032   bool defaultAction = true;
1033   nsresult rv = nsContentUtils::DispatchEventOnlyToChrome(
1034       OwnerDoc(), static_cast<nsINode*>(this),
1035       aEarlyNotify ? u"DOMFormBeforeSubmit"_ns : u"DOMFormSubmit"_ns,
1036       CanBubble::eYes, Cancelable::eYes, &defaultAction);
1037   *aCancelSubmit = !defaultAction;
1038   if (*aCancelSubmit) {
1039     return NS_OK;
1040   }
1041   return rv;
1042 }
1043
1044 nsresult HTMLFormElement::ConstructEntryList(FormData* aFormData) {
1045   MOZ_ASSERT(aFormData, "Must have FormData!");
1046   if (mIsConstructingEntryList) {
1047     // Step 2.2 of https://xhr.spec.whatwg.org/#dom-formdata.
1048     return NS_ERROR_DOM_INVALID_STATE_ERR;
1049   }
1050
1051   AutoRestore<bool> resetConstructingEntryList(mIsConstructingEntryList);
1052   mIsConstructingEntryList = true;
1053   // This shouldn't be called recursively, so use a rather large value
1054   // for the preallocated buffer.
1055   AutoTArray<RefPtr<nsGenericHTMLFormElement>, 100> sortedControls;
1056   nsresult rv = mControls->GetSortedControls(sortedControls);
1057   NS_ENSURE_SUCCESS(rv, rv);
1058
1059   // Walk the list of nodes and call SubmitNamesValues() on the controls
1060   for (nsGenericHTMLFormElement* control : sortedControls) {
1061     // Disabled elements don't submit
1062     if (!control->IsDisabled()) {
1063       nsCOMPtr<nsIFormControl> fc = do_QueryInterface(control);
1064       MOZ_ASSERT(fc);
1065       // Tell the control to submit its name/value pairs to the submission
1066       fc->SubmitNamesValues(aFormData);
1067     }
1068   }
1069
1070   FormDataEventInit init;
1071   init.mBubbles = true;
1072   init.mCancelable = false;
1073   init.mFormData = aFormData;
1074   RefPtr<FormDataEvent> event =
1075       FormDataEvent::Constructor(this, u"formdata"_ns, init);
1076   event->SetTrusted(true);
1077
1078   EventDispatcher::DispatchDOMEvent(this, nullptr, event, nullptr, nullptr);
1079
1080   return NS_OK;
1081 }
1082
1083 NotNull<const Encoding*> HTMLFormElement::GetSubmitEncoding() {
1084   nsAutoString acceptCharsetValue;
1085   GetAttr(nsGkAtoms::acceptcharset, acceptCharsetValue);
1086
1087   int32_t charsetLen = acceptCharsetValue.Length();
1088   if (charsetLen > 0) {
1089     int32_t offset = 0;
1090     int32_t spPos = 0;
1091     // get charset from charsets one by one
1092     do {
1093       spPos = acceptCharsetValue.FindChar(char16_t(' '), offset);
1094       int32_t cnt = ((-1 == spPos) ? (charsetLen - offset) : (spPos - offset));
1095       if (cnt > 0) {
1096         nsAutoString uCharset;
1097         acceptCharsetValue.Mid(uCharset, offset, cnt);
1098
1099         auto encoding = Encoding::ForLabelNoReplacement(uCharset);
1100         if (encoding) {
1101           return WrapNotNull(encoding);
1102         }
1103       }
1104       offset = spPos + 1;
1105     } while (spPos != -1);
1106   }
1107   // if there are no accept-charset or all the charset are not supported
1108   // Get the charset from document
1109   Document* doc = GetComposedDoc();
1110   if (doc) {
1111     return doc->GetDocumentCharacterSet();
1112   }
1113   return UTF_8_ENCODING;
1114 }
1115
1116 Element* HTMLFormElement::IndexedGetter(uint32_t aIndex, bool& aFound) {
1117   Element* element = mControls->mElements->SafeElementAt(aIndex, nullptr);
1118   aFound = element != nullptr;
1119   return element;
1120 }
1121
1122 #ifdef DEBUG
1123 /**
1124  * Checks that all form elements are in document order. Asserts if any pair of
1125  * consecutive elements are not in increasing document order.
1126  *
1127  * @param aControls List of form controls to check.
1128  * @param aForm Parent form of the controls.
1129  */
1130 /* static */
1131 void HTMLFormElement::AssertDocumentOrder(
1132     const nsTArray<nsGenericHTMLFormElement*>& aControls, nsIContent* aForm) {
1133   // TODO: remove the if directive with bug 598468.
1134   // This is done to prevent asserts in some edge cases.
1135 #  if 0
1136   // Only iterate if aControls is not empty, since otherwise
1137   // |aControls.Length() - 1| will be a very large unsigned number... not what
1138   // we want here.
1139   if (!aControls.IsEmpty()) {
1140     for (uint32_t i = 0; i < aControls.Length() - 1; ++i) {
1141       NS_ASSERTION(
1142           CompareFormControlPosition(aControls[i], aControls[i + 1], aForm) < 0,
1143           "Form controls not ordered correctly");
1144     }
1145   }
1146 #  endif
1147 }
1148
1149 /**
1150  * Copy of the above function, but with RefPtrs.
1151  *
1152  * @param aControls List of form controls to check.
1153  * @param aForm Parent form of the controls.
1154  */
1155 /* static */
1156 void HTMLFormElement::AssertDocumentOrder(
1157     const nsTArray<RefPtr<nsGenericHTMLFormElement>>& aControls,
1158     nsIContent* aForm) {
1159   // TODO: remove the if directive with bug 598468.
1160   // This is done to prevent asserts in some edge cases.
1161 #  if 0
1162   // Only iterate if aControls is not empty, since otherwise
1163   // |aControls.Length() - 1| will be a very large unsigned number... not what
1164   // we want here.
1165   if (!aControls.IsEmpty()) {
1166     for (uint32_t i = 0; i < aControls.Length() - 1; ++i) {
1167       NS_ASSERTION(
1168           CompareFormControlPosition(aControls[i], aControls[i + 1], aForm) < 0,
1169           "Form controls not ordered correctly");
1170     }
1171   }
1172 #  endif
1173 }
1174 #endif
1175
1176 nsresult HTMLFormElement::AddElement(nsGenericHTMLFormElement* aChild,
1177                                      bool aUpdateValidity, bool aNotify) {
1178   // If an element has a @form, we can assume it *might* be able to not have
1179   // a parent and still be in the form.
1180   NS_ASSERTION(aChild->HasAttr(nsGkAtoms::form) || aChild->GetParent(),
1181                "Form control should have a parent");
1182   nsCOMPtr<nsIFormControl> fc = do_QueryObject(aChild);
1183   MOZ_ASSERT(fc);
1184   // Determine whether to add the new element to the elements or
1185   // the not-in-elements list.
1186   bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(fc);
1187   TreeOrderedArray<nsGenericHTMLFormElement*>& controlList =
1188       childInElements ? mControls->mElements : mControls->mNotInElements;
1189
1190   const size_t insertedIndex = controlList.Insert(*aChild, this);
1191   const bool lastElement = controlList->Length() == insertedIndex + 1;
1192
1193 #ifdef DEBUG
1194   AssertDocumentOrder(controlList, this);
1195 #endif
1196
1197   auto type = fc->ControlType();
1198
1199   // Default submit element handling
1200   if (fc->IsSubmitControl()) {
1201     // Update mDefaultSubmitElement, mFirstSubmitInElements,
1202     // mFirstSubmitNotInElements.
1203
1204     nsGenericHTMLFormElement** firstSubmitSlot =
1205         childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
1206
1207     // The new child is the new first submit in its list if the firstSubmitSlot
1208     // is currently empty or if the child is before what's currently in the
1209     // slot.  Note that if we already have a control in firstSubmitSlot and
1210     // we're appending this element can't possibly replace what's currently in
1211     // the slot.  Also note that aChild can't become the mDefaultSubmitElement
1212     // unless it replaces what's in the slot.  If it _does_ replace what's in
1213     // the slot, it becomes the default submit if either the default submit is
1214     // what's in the slot or the child is earlier than the default submit.
1215     if (!*firstSubmitSlot ||
1216         (!lastElement && nsContentUtils::CompareTreePosition<TreeKind::DOM>(
1217                              aChild, *firstSubmitSlot, this) < 0)) {
1218       // Update mDefaultSubmitElement if it's currently in a valid state.
1219       // Valid state means either non-null or null because there are in fact
1220       // no submit elements around.
1221       if ((mDefaultSubmitElement ||
1222            (!mFirstSubmitInElements && !mFirstSubmitNotInElements)) &&
1223           (*firstSubmitSlot == mDefaultSubmitElement ||
1224            nsContentUtils::CompareTreePosition<TreeKind::DOM>(
1225                aChild, mDefaultSubmitElement, this) < 0)) {
1226         SetDefaultSubmitElement(aChild);
1227       }
1228       *firstSubmitSlot = aChild;
1229     }
1230
1231     MOZ_ASSERT(mDefaultSubmitElement == mFirstSubmitInElements ||
1232                    mDefaultSubmitElement == mFirstSubmitNotInElements ||
1233                    !mDefaultSubmitElement,
1234                "What happened here?");
1235   }
1236
1237   // If the element is subject to constraint validaton and is invalid, we need
1238   // to update our internal counter.
1239   if (aUpdateValidity) {
1240     nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild);
1241     if (cvElmt && cvElmt->IsCandidateForConstraintValidation() &&
1242         !cvElmt->IsValid()) {
1243       UpdateValidity(false);
1244     }
1245   }
1246
1247   // Notify the radio button it's been added to a group
1248   // This has to be done _after_ UpdateValidity() call to prevent the element
1249   // being count twice.
1250   if (type == FormControlType::InputRadio) {
1251     RefPtr<HTMLInputElement> radio = static_cast<HTMLInputElement*>(aChild);
1252     radio->AddToRadioGroup();
1253   }
1254
1255   return NS_OK;
1256 }
1257
1258 nsresult HTMLFormElement::AddElementToTable(nsGenericHTMLFormElement* aChild,
1259                                             const nsAString& aName) {
1260   return mControls->AddElementToTable(aChild, aName);
1261 }
1262
1263 void HTMLFormElement::SetDefaultSubmitElement(
1264     nsGenericHTMLFormElement* aElement) {
1265   if (mDefaultSubmitElement) {
1266     // It just so happens that a radio button or an <option> can't be our
1267     // default submit element, so we can just blindly remove the bit.
1268     mDefaultSubmitElement->RemoveStates(ElementState::DEFAULT);
1269   }
1270   mDefaultSubmitElement = aElement;
1271   if (mDefaultSubmitElement) {
1272     mDefaultSubmitElement->AddStates(ElementState::DEFAULT);
1273   }
1274 }
1275
1276 nsresult HTMLFormElement::RemoveElement(nsGenericHTMLFormElement* aChild,
1277                                         bool aUpdateValidity) {
1278   RemoveElementFromPastNamesMap(aChild);
1279
1280   //
1281   // Remove it from the radio group if it's a radio button
1282   //
1283   nsresult rv = NS_OK;
1284   nsCOMPtr<nsIFormControl> fc = do_QueryInterface(aChild);
1285   MOZ_ASSERT(fc);
1286   if (fc->ControlType() == FormControlType::InputRadio) {
1287     RefPtr<HTMLInputElement> radio = static_cast<HTMLInputElement*>(aChild);
1288     radio->RemoveFromRadioGroup();
1289   }
1290
1291   // Determine whether to remove the child from the elements list
1292   // or the not in elements list.
1293   bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(fc);
1294   TreeOrderedArray<nsGenericHTMLFormElement*>& controls =
1295       childInElements ? mControls->mElements : mControls->mNotInElements;
1296
1297   // Find the index of the child. This will be used later if necessary
1298   // to find the default submit.
1299   size_t index = controls->IndexOf(aChild);
1300   NS_ENSURE_STATE(index != controls.AsList().NoIndex);
1301
1302   controls.RemoveElementAt(index);
1303
1304   // Update our mFirstSubmit* values.
1305   nsGenericHTMLFormElement** firstSubmitSlot =
1306       childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
1307   if (aChild == *firstSubmitSlot) {
1308     *firstSubmitSlot = nullptr;
1309
1310     // We are removing the first submit in this list, find the new first submit
1311     uint32_t length = controls->Length();
1312     for (uint32_t i = index; i < length; ++i) {
1313       nsCOMPtr<nsIFormControl> currentControl =
1314           do_QueryInterface(controls->ElementAt(i));
1315       MOZ_ASSERT(currentControl);
1316       if (currentControl->IsSubmitControl()) {
1317         *firstSubmitSlot = controls->ElementAt(i);
1318         break;
1319       }
1320     }
1321   }
1322
1323   if (aChild == mDefaultSubmitElement) {
1324     // Need to reset mDefaultSubmitElement.  Do this asynchronously so
1325     // that we're not doing it while the DOM is in flux.
1326     SetDefaultSubmitElement(nullptr);
1327     nsContentUtils::AddScriptRunner(new RemoveElementRunnable(this));
1328
1329     // Note that we don't need to notify on the old default submit (which is
1330     // being removed) because it's either being removed from the DOM or
1331     // changing attributes in a way that makes it responsible for sending its
1332     // own notifications.
1333   }
1334
1335   // If the element was subject to constraint validation and is invalid, we need
1336   // to update our internal counter.
1337   if (aUpdateValidity) {
1338     nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild);
1339     if (cvElmt && cvElmt->IsCandidateForConstraintValidation() &&
1340         !cvElmt->IsValid()) {
1341       UpdateValidity(true);
1342     }
1343   }
1344
1345   return rv;
1346 }
1347
1348 void HTMLFormElement::HandleDefaultSubmitRemoval() {
1349   if (mDefaultSubmitElement) {
1350     // Already got reset somehow; nothing else to do here
1351     return;
1352   }
1353
1354   nsGenericHTMLFormElement* newDefaultSubmit;
1355   if (!mFirstSubmitNotInElements) {
1356     newDefaultSubmit = mFirstSubmitInElements;
1357   } else if (!mFirstSubmitInElements) {
1358     newDefaultSubmit = mFirstSubmitNotInElements;
1359   } else {
1360     NS_ASSERTION(mFirstSubmitInElements != mFirstSubmitNotInElements,
1361                  "How did that happen?");
1362     // Have both; use the earlier one
1363     newDefaultSubmit =
1364         nsContentUtils::CompareTreePosition<TreeKind::DOM>(
1365             mFirstSubmitInElements, mFirstSubmitNotInElements, this) < 0
1366             ? mFirstSubmitInElements
1367             : mFirstSubmitNotInElements;
1368   }
1369   SetDefaultSubmitElement(newDefaultSubmit);
1370
1371   MOZ_ASSERT(mDefaultSubmitElement == mFirstSubmitInElements ||
1372                  mDefaultSubmitElement == mFirstSubmitNotInElements,
1373              "What happened here?");
1374 }
1375
1376 nsresult HTMLFormElement::RemoveElementFromTableInternal(
1377     nsInterfaceHashtable<nsStringHashKey, nsISupports>& aTable,
1378     nsIContent* aChild, const nsAString& aName) {
1379   auto entry = aTable.Lookup(aName);
1380   if (!entry) {
1381     return NS_OK;
1382   }
1383   // Single element in the hash, just remove it if it's the one
1384   // we're trying to remove...
1385   if (entry.Data() == aChild) {
1386     entry.Remove();
1387     ++mExpandoAndGeneration.generation;
1388     return NS_OK;
1389   }
1390
1391   nsCOMPtr<nsIContent> content(do_QueryInterface(entry.Data()));
1392   if (content) {
1393     return NS_OK;
1394   }
1395
1396   // If it's not a content node then it must be a RadioNodeList.
1397   MOZ_ASSERT(nsCOMPtr<RadioNodeList>(do_QueryInterface(entry.Data())));
1398   auto* list = static_cast<RadioNodeList*>(entry->get());
1399
1400   list->RemoveElement(aChild);
1401
1402   uint32_t length = list->Length();
1403
1404   if (!length) {
1405     // If the list is empty we remove if from our hash, this shouldn't
1406     // happen tho
1407     entry.Remove();
1408     ++mExpandoAndGeneration.generation;
1409   } else if (length == 1) {
1410     // Only one element left, replace the list in the hash with the
1411     // single element.
1412     nsIContent* node = list->Item(0);
1413     if (node) {
1414       entry.Data() = node;
1415     }
1416   }
1417
1418   return NS_OK;
1419 }
1420
1421 nsresult HTMLFormElement::RemoveElementFromTable(
1422     nsGenericHTMLFormElement* aElement, const nsAString& aName) {
1423   return mControls->RemoveElementFromTable(aElement, aName);
1424 }
1425
1426 already_AddRefed<nsISupports> HTMLFormElement::NamedGetter(
1427     const nsAString& aName, bool& aFound) {
1428   aFound = true;
1429
1430   nsCOMPtr<nsISupports> result = DoResolveName(aName);
1431   if (result) {
1432     AddToPastNamesMap(aName, result);
1433     return result.forget();
1434   }
1435
1436   result = mImageNameLookupTable.GetWeak(aName);
1437   if (result) {
1438     AddToPastNamesMap(aName, result);
1439     return result.forget();
1440   }
1441
1442   result = mPastNameLookupTable.GetWeak(aName);
1443   if (result) {
1444     return result.forget();
1445   }
1446
1447   aFound = false;
1448   return nullptr;
1449 }
1450
1451 void HTMLFormElement::GetSupportedNames(nsTArray<nsString>& aRetval) {
1452   // TODO https://github.com/whatwg/html/issues/1731
1453 }
1454
1455 already_AddRefed<nsISupports> HTMLFormElement::FindNamedItem(
1456     const nsAString& aName, nsWrapperCache** aCache) {
1457   // FIXME Get the wrapper cache from DoResolveName.
1458
1459   bool found;
1460   nsCOMPtr<nsISupports> result = NamedGetter(aName, found);
1461   if (result) {
1462     *aCache = nullptr;
1463     return result.forget();
1464   }
1465
1466   return nullptr;
1467 }
1468
1469 already_AddRefed<nsISupports> HTMLFormElement::DoResolveName(
1470     const nsAString& aName) {
1471   nsCOMPtr<nsISupports> result = mControls->NamedItemInternal(aName);
1472   return result.forget();
1473 }
1474
1475 void HTMLFormElement::OnSubmitClickBegin(Element* aOriginatingElement) {
1476   mDeferSubmission = true;
1477
1478   // Prepare to run NotifySubmitObservers early before the
1479   // scripts on the page get to modify the form data, possibly
1480   // throwing off any password manager. (bug 257781)
1481   nsCOMPtr<nsIURI> actionURI;
1482   nsresult rv;
1483
1484   rv = GetActionURL(getter_AddRefs(actionURI), aOriginatingElement);
1485   if (NS_FAILED(rv) || !actionURI) return;
1486
1487   // Notify observers of submit if the form is valid.
1488   // TODO: checking for mInvalidElementsCount is a temporary fix that should be
1489   // removed with bug 610402.
1490   if (mInvalidElementsCount == 0) {
1491     bool cancelSubmit = false;
1492     rv = NotifySubmitObservers(actionURI, &cancelSubmit, true);
1493     if (NS_SUCCEEDED(rv)) {
1494       mNotifiedObservers = true;
1495       mNotifiedObserversResult = cancelSubmit;
1496     }
1497   }
1498 }
1499
1500 void HTMLFormElement::OnSubmitClickEnd() { mDeferSubmission = false; }
1501
1502 void HTMLFormElement::FlushPendingSubmission() {
1503   MOZ_ASSERT(!mDeferSubmission);
1504
1505   if (mPendingSubmission) {
1506     // Transfer owning reference so that the submission doesn't get deleted
1507     // if we reenter
1508     UniquePtr<HTMLFormSubmission> submission = std::move(mPendingSubmission);
1509
1510     SubmitSubmission(submission.get());
1511   }
1512 }
1513
1514 void HTMLFormElement::GetAction(nsString& aValue) {
1515   if (!GetAttr(nsGkAtoms::action, aValue) || aValue.IsEmpty()) {
1516     Document* document = OwnerDoc();
1517     nsIURI* docURI = document->GetDocumentURI();
1518     if (docURI) {
1519       nsAutoCString spec;
1520       nsresult rv = docURI->GetSpec(spec);
1521       if (NS_FAILED(rv)) {
1522         return;
1523       }
1524
1525       CopyUTF8toUTF16(spec, aValue);
1526     }
1527   } else {
1528     GetURIAttr(nsGkAtoms::action, nullptr, aValue);
1529   }
1530 }
1531
1532 nsresult HTMLFormElement::GetActionURL(nsIURI** aActionURL,
1533                                        Element* aOriginatingElement) {
1534   nsresult rv = NS_OK;
1535
1536   *aActionURL = nullptr;
1537
1538   //
1539   // Grab the URL string
1540   //
1541   // If the originating element is a submit control and has the formaction
1542   // attribute specified, it should be used. Otherwise, the action attribute
1543   // from the form element should be used.
1544   //
1545   nsAutoString action;
1546
1547   if (aOriginatingElement &&
1548       aOriginatingElement->HasAttr(nsGkAtoms::formaction)) {
1549 #ifdef DEBUG
1550     nsCOMPtr<nsIFormControl> formControl =
1551         do_QueryInterface(aOriginatingElement);
1552     NS_ASSERTION(formControl && formControl->IsSubmitControl(),
1553                  "The originating element must be a submit form control!");
1554 #endif  // DEBUG
1555
1556     HTMLInputElement* inputElement =
1557         HTMLInputElement::FromNode(aOriginatingElement);
1558     if (inputElement) {
1559       inputElement->GetFormAction(action);
1560     } else {
1561       auto buttonElement = HTMLButtonElement::FromNode(aOriginatingElement);
1562       if (buttonElement) {
1563         buttonElement->GetFormAction(action);
1564       } else {
1565         NS_ERROR("Originating element must be an input or button element!");
1566         return NS_ERROR_UNEXPECTED;
1567       }
1568     }
1569   } else {
1570     GetAction(action);
1571   }
1572
1573   //
1574   // Form the full action URL
1575   //
1576
1577   // Get the document to form the URL.
1578   // We'll also need it later to get the DOM window when notifying form submit
1579   // observers (bug 33203)
1580   if (!IsInComposedDoc()) {
1581     return NS_OK;  // No doc means don't submit, see Bug 28988
1582   }
1583
1584   // Get base URL
1585   Document* document = OwnerDoc();
1586   nsIURI* docURI = document->GetDocumentURI();
1587   NS_ENSURE_TRUE(docURI, NS_ERROR_UNEXPECTED);
1588
1589   // If an action is not specified and we are inside
1590   // a HTML document then reload the URL. This makes us
1591   // compatible with 4.x browsers.
1592   // If we are in some other type of document such as XML or
1593   // XUL, do nothing. This prevents undesirable reloading of
1594   // a document inside XUL.
1595
1596   nsCOMPtr<nsIURI> actionURL;
1597   if (action.IsEmpty()) {
1598     if (!document->IsHTMLOrXHTML()) {
1599       // Must be a XML, XUL or other non-HTML document type
1600       // so do nothing.
1601       return NS_OK;
1602     }
1603
1604     actionURL = docURI;
1605   } else {
1606     nsIURI* baseURL = GetBaseURI();
1607     NS_ASSERTION(baseURL, "No Base URL found in Form Submit!\n");
1608     if (!baseURL) {
1609       return NS_OK;  // No base URL -> exit early, see Bug 30721
1610     }
1611     rv = NS_NewURI(getter_AddRefs(actionURL), action, nullptr, baseURL);
1612     NS_ENSURE_SUCCESS(rv, rv);
1613   }
1614
1615   //
1616   // Verify the URL should be reached
1617   //
1618   // Get security manager, check to see if access to action URI is allowed.
1619   //
1620   nsIScriptSecurityManager* securityManager =
1621       nsContentUtils::GetSecurityManager();
1622   rv = securityManager->CheckLoadURIWithPrincipal(
1623       NodePrincipal(), actionURL, nsIScriptSecurityManager::STANDARD,
1624       OwnerDoc()->InnerWindowID());
1625   NS_ENSURE_SUCCESS(rv, rv);
1626
1627   // Potentially the page uses the CSP directive 'upgrade-insecure-requests'. In
1628   // such a case we have to upgrade the action url from http:// to https://.
1629   // The upgrade is only required if the actionURL is http and not a potentially
1630   // trustworthy loopback URI.
1631   bool needsUpgrade =
1632       actionURL->SchemeIs("http") &&
1633       !nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL(actionURL) &&
1634       document->GetUpgradeInsecureRequests(false);
1635   if (needsUpgrade) {
1636     // let's use the old specification before the upgrade for logging
1637     AutoTArray<nsString, 2> params;
1638     nsAutoCString spec;
1639     rv = actionURL->GetSpec(spec);
1640     NS_ENSURE_SUCCESS(rv, rv);
1641     CopyUTF8toUTF16(spec, *params.AppendElement());
1642
1643     // upgrade the actionURL from http:// to use https://
1644     nsCOMPtr<nsIURI> upgradedActionURL;
1645     rv = NS_GetSecureUpgradedURI(actionURL, getter_AddRefs(upgradedActionURL));
1646     NS_ENSURE_SUCCESS(rv, rv);
1647     actionURL = std::move(upgradedActionURL);
1648
1649     // let's log a message to the console that we are upgrading a request
1650     nsAutoCString scheme;
1651     rv = actionURL->GetScheme(scheme);
1652     NS_ENSURE_SUCCESS(rv, rv);
1653     CopyUTF8toUTF16(scheme, *params.AppendElement());
1654
1655     CSP_LogLocalizedStr(
1656         "upgradeInsecureRequest", params,
1657         u""_ns,  // aSourceFile
1658         u""_ns,  // aScriptSample
1659         0,       // aLineNumber
1660         1,       // aColumnNumber
1661         nsIScriptError::warningFlag, "upgradeInsecureRequest"_ns,
1662         document->InnerWindowID(),
1663         !!document->NodePrincipal()->OriginAttributesRef().mPrivateBrowsingId);
1664   }
1665
1666   //
1667   // Assign to the output
1668   //
1669   actionURL.forget(aActionURL);
1670
1671   return rv;
1672 }
1673
1674 nsGenericHTMLFormElement* HTMLFormElement::GetDefaultSubmitElement() const {
1675   MOZ_ASSERT(mDefaultSubmitElement == mFirstSubmitInElements ||
1676                  mDefaultSubmitElement == mFirstSubmitNotInElements,
1677              "What happened here?");
1678
1679   return mDefaultSubmitElement;
1680 }
1681
1682 bool HTMLFormElement::ImplicitSubmissionIsDisabled() const {
1683   // Input text controls are always in the elements list.
1684   uint32_t numDisablingControlsFound = 0;
1685   uint32_t length = mControls->mElements->Length();
1686   for (uint32_t i = 0; i < length && numDisablingControlsFound < 2; ++i) {
1687     nsCOMPtr<nsIFormControl> fc =
1688         do_QueryInterface(mControls->mElements->ElementAt(i));
1689     MOZ_ASSERT(fc);
1690     if (fc->IsSingleLineTextControl(false)) {
1691       numDisablingControlsFound++;
1692     }
1693   }
1694   return numDisablingControlsFound != 1;
1695 }
1696
1697 bool HTMLFormElement::IsLastActiveElement(
1698     const nsGenericHTMLFormElement* aElement) const {
1699   MOZ_ASSERT(aElement, "Unexpected call");
1700
1701   for (auto* element : Reversed(mControls->mElements.AsList())) {
1702     nsCOMPtr<nsIFormControl> fc = do_QueryInterface(element);
1703     MOZ_ASSERT(fc);
1704     // XXX How about date/time control?
1705     if (fc->IsTextControl(false) && !element->IsDisabled()) {
1706       return element == aElement;
1707     }
1708   }
1709   return false;
1710 }
1711
1712 int32_t HTMLFormElement::Length() { return mControls->Length(); }
1713
1714 void HTMLFormElement::ForgetCurrentSubmission() {
1715   mNotifiedObservers = false;
1716   mTargetContext = nullptr;
1717   mCurrentLoadId = Nothing();
1718 }
1719
1720 bool HTMLFormElement::CheckFormValidity(
1721     nsTArray<RefPtr<Element>>* aInvalidElements) const {
1722   bool ret = true;
1723
1724   // This shouldn't be called recursively, so use a rather large value
1725   // for the preallocated buffer.
1726   AutoTArray<RefPtr<nsGenericHTMLFormElement>, 100> sortedControls;
1727   if (NS_FAILED(mControls->GetSortedControls(sortedControls))) {
1728     return false;
1729   }
1730
1731   uint32_t len = sortedControls.Length();
1732
1733   for (uint32_t i = 0; i < len; ++i) {
1734     nsCOMPtr<nsIConstraintValidation> cvElmt =
1735         do_QueryObject(sortedControls[i]);
1736     bool defaultAction = true;
1737     if (cvElmt && !cvElmt->CheckValidity(*sortedControls[i], &defaultAction)) {
1738       ret = false;
1739
1740       // Add all unhandled invalid controls to aInvalidElements if the caller
1741       // requested them.
1742       if (defaultAction && aInvalidElements) {
1743         aInvalidElements->AppendElement(sortedControls[i]);
1744       }
1745     }
1746   }
1747
1748   return ret;
1749 }
1750
1751 bool HTMLFormElement::CheckValidFormSubmission() {
1752   /**
1753    * Check for form validity: do not submit a form if there are unhandled
1754    * invalid controls in the form.
1755    * This should not be done if the form has been submitted with .submit() or
1756    * has been submitted and novalidate/formnovalidate is used.
1757    *
1758    * NOTE: for the moment, we are also checking that whether the MozInvalidForm
1759    * event gets prevented default so it will prevent blocking form submission if
1760    * the browser does not have implemented a UI yet.
1761    *
1762    * TODO: the check for MozInvalidForm event should be removed later when HTML5
1763    * Forms will be spread enough and authors will assume forms can't be
1764    * submitted when invalid. See bug 587671.
1765    */
1766
1767   AutoTArray<RefPtr<Element>, 32> invalidElements;
1768   if (CheckFormValidity(&invalidElements)) {
1769     return true;
1770   }
1771
1772   AutoJSAPI jsapi;
1773   if (!jsapi.Init(GetOwnerGlobal())) {
1774     return false;
1775   }
1776   JS::Rooted<JS::Value> detail(jsapi.cx());
1777   if (!ToJSValue(jsapi.cx(), invalidElements, &detail)) {
1778     return false;
1779   }
1780
1781   RefPtr<CustomEvent> event =
1782       NS_NewDOMCustomEvent(OwnerDoc(), nullptr, nullptr);
1783   event->InitCustomEvent(jsapi.cx(), u"MozInvalidForm"_ns,
1784                          /* CanBubble */ true,
1785                          /* Cancelable */ true, detail);
1786   event->SetTrusted(true);
1787   event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
1788
1789   DispatchEvent(*event);
1790
1791   ReportInvalidUnfocusableElements(std::move(invalidElements));
1792
1793   return !event->DefaultPrevented();
1794 }
1795
1796 void HTMLFormElement::UpdateValidity(bool aElementValidity) {
1797   if (aElementValidity) {
1798     --mInvalidElementsCount;
1799   } else {
1800     ++mInvalidElementsCount;
1801   }
1802
1803   NS_ASSERTION(mInvalidElementsCount >= 0, "Something went seriously wrong!");
1804
1805   // The form validity has just changed if:
1806   // - there are no more invalid elements ;
1807   // - or there is one invalid elmement and an element just became invalid.
1808   // If we have invalid elements and we used to before as well, do nothing.
1809   if (mInvalidElementsCount &&
1810       (mInvalidElementsCount != 1 || aElementValidity)) {
1811     return;
1812   }
1813
1814   AutoStateChangeNotifier notifier(*this, true);
1815   RemoveStatesSilently(ElementState::VALID | ElementState::INVALID);
1816   AddStatesSilently(mInvalidElementsCount ? ElementState::INVALID
1817                                           : ElementState::VALID);
1818 }
1819
1820 int32_t HTMLFormElement::IndexOfContent(nsIContent* aContent) {
1821   int32_t index = 0;
1822   return mControls->IndexOfContent(aContent, &index) == NS_OK ? index : 0;
1823 }
1824
1825 void HTMLFormElement::Clear() {
1826   for (HTMLImageElement* image : Reversed(mImageElements.AsList())) {
1827     image->ClearForm(false);
1828   }
1829   mImageElements.Clear();
1830   mImageNameLookupTable.Clear();
1831   mPastNameLookupTable.Clear();
1832 }
1833
1834 namespace {
1835
1836 struct PositionComparator {
1837   nsIContent* const mElement;
1838   explicit PositionComparator(nsIContent* const aElement)
1839       : mElement(aElement) {}
1840
1841   int operator()(nsIContent* aElement) const {
1842     if (mElement == aElement) {
1843       return 0;
1844     }
1845     if (nsContentUtils::PositionIsBefore(mElement, aElement)) {
1846       return -1;
1847     }
1848     return 1;
1849   }
1850 };
1851
1852 struct RadioNodeListAdaptor {
1853   RadioNodeList* const mList;
1854   explicit RadioNodeListAdaptor(RadioNodeList* aList) : mList(aList) {}
1855   nsIContent* operator[](size_t aIdx) const { return mList->Item(aIdx); }
1856 };
1857
1858 }  // namespace
1859
1860 nsresult HTMLFormElement::AddElementToTableInternal(
1861     nsInterfaceHashtable<nsStringHashKey, nsISupports>& aTable,
1862     nsIContent* aChild, const nsAString& aName) {
1863   return aTable.WithEntryHandle(aName, [&](auto&& entry) {
1864     if (!entry) {
1865       // No entry found, add the element
1866       entry.Insert(aChild);
1867       ++mExpandoAndGeneration.generation;
1868     } else {
1869       // Found something in the hash, check its type
1870       nsCOMPtr<nsIContent> content = do_QueryInterface(entry.Data());
1871
1872       if (content) {
1873         // Check if the new content is the same as the one we found in the
1874         // hash, if it is then we leave it in the hash as it is, this will
1875         // happen if a form control has both a name and an id with the same
1876         // value
1877         if (content == aChild) {
1878           return NS_OK;
1879         }
1880
1881         // Found an element, create a list, add the element to the list and put
1882         // the list in the hash
1883         RadioNodeList* list = new RadioNodeList(this);
1884
1885         // If an element has a @form, we can assume it *might* be able to not
1886         // have a parent and still be in the form.
1887         NS_ASSERTION(
1888             (content->IsElement() && content->AsElement()->HasAttr(
1889                                          kNameSpaceID_None, nsGkAtoms::form)) ||
1890                 content->GetParent(),
1891             "Item in list without parent");
1892
1893         // Determine the ordering between the new and old element.
1894         bool newFirst = nsContentUtils::PositionIsBefore(aChild, content);
1895
1896         list->AppendElement(newFirst ? aChild : content.get());
1897         list->AppendElement(newFirst ? content.get() : aChild);
1898
1899         nsCOMPtr<nsISupports> listSupports = do_QueryObject(list);
1900
1901         // Replace the element with the list.
1902         entry.Data() = listSupports;
1903       } else {
1904         // There's already a list in the hash, add the child to the list.
1905         MOZ_ASSERT(nsCOMPtr<RadioNodeList>(do_QueryInterface(entry.Data())));
1906         auto* list = static_cast<RadioNodeList*>(entry->get());
1907
1908         NS_ASSERTION(
1909             list->Length() > 1,
1910             "List should have been converted back to a single element");
1911
1912         // Fast-path appends; this check is ok even if the child is
1913         // already in the list, since if it tests true the child would
1914         // have come at the end of the list, and the PositionIsBefore
1915         // will test false.
1916         if (nsContentUtils::PositionIsBefore(list->Item(list->Length() - 1),
1917                                              aChild)) {
1918           list->AppendElement(aChild);
1919           return NS_OK;
1920         }
1921
1922         // If a control has a name equal to its id, it could be in the
1923         // list already.
1924         if (list->IndexOf(aChild) != -1) {
1925           return NS_OK;
1926         }
1927
1928         size_t idx;
1929         DebugOnly<bool> found =
1930             BinarySearchIf(RadioNodeListAdaptor(list), 0, list->Length(),
1931                            PositionComparator(aChild), &idx);
1932         MOZ_ASSERT(!found, "should not have found an element");
1933
1934         list->InsertElementAt(aChild, idx);
1935       }
1936     }
1937
1938     return NS_OK;
1939   });
1940 }
1941
1942 nsresult HTMLFormElement::AddImageElement(HTMLImageElement* aElement) {
1943   mImageElements.Insert(*aElement, this);
1944   return NS_OK;
1945 }
1946
1947 nsresult HTMLFormElement::AddImageElementToTable(HTMLImageElement* aChild,
1948                                                  const nsAString& aName) {
1949   return AddElementToTableInternal(mImageNameLookupTable, aChild, aName);
1950 }
1951
1952 nsresult HTMLFormElement::RemoveImageElement(HTMLImageElement* aElement) {
1953   RemoveElementFromPastNamesMap(aElement);
1954   mImageElements.RemoveElement(*aElement);
1955   return NS_OK;
1956 }
1957
1958 nsresult HTMLFormElement::RemoveImageElementFromTable(
1959     HTMLImageElement* aElement, const nsAString& aName) {
1960   return RemoveElementFromTableInternal(mImageNameLookupTable, aElement, aName);
1961 }
1962
1963 void HTMLFormElement::AddToPastNamesMap(const nsAString& aName,
1964                                         nsISupports* aChild) {
1965   // If candidates contains exactly one node. Add a mapping from name to the
1966   // node in candidates in the form element's past names map, replacing the
1967   // previous entry with the same name, if any.
1968   nsCOMPtr<nsIContent> node = do_QueryInterface(aChild);
1969   if (node) {
1970     mPastNameLookupTable.InsertOrUpdate(aName, ToSupports(node));
1971     node->SetFlags(MAY_BE_IN_PAST_NAMES_MAP);
1972   }
1973 }
1974
1975 void HTMLFormElement::RemoveElementFromPastNamesMap(Element* aElement) {
1976   if (!aElement->HasFlag(MAY_BE_IN_PAST_NAMES_MAP)) {
1977     return;
1978   }
1979
1980   aElement->UnsetFlags(MAY_BE_IN_PAST_NAMES_MAP);
1981
1982   uint32_t oldCount = mPastNameLookupTable.Count();
1983   for (auto iter = mPastNameLookupTable.Iter(); !iter.Done(); iter.Next()) {
1984     if (aElement == iter.Data()) {
1985       iter.Remove();
1986     }
1987   }
1988   if (oldCount != mPastNameLookupTable.Count()) {
1989     ++mExpandoAndGeneration.generation;
1990   }
1991 }
1992
1993 JSObject* HTMLFormElement::WrapNode(JSContext* aCx,
1994                                     JS::Handle<JSObject*> aGivenProto) {
1995   return HTMLFormElement_Binding::Wrap(aCx, this, aGivenProto);
1996 }
1997
1998 int32_t HTMLFormElement::GetFormNumberForStateKey() {
1999   if (mFormNumber == -1) {
2000     mFormNumber = OwnerDoc()->GetNextFormNumber();
2001   }
2002   return mFormNumber;
2003 }
2004
2005 void HTMLFormElement::NodeInfoChanged(Document* aOldDoc) {
2006   nsGenericHTMLElement::NodeInfoChanged(aOldDoc);
2007
2008   // When a <form> element is adopted into a new document, we want any state
2009   // keys generated from it to no longer consider this element to be parser
2010   // inserted, and so have state keys based on the position of the <form>
2011   // element in the document, rather than the order it was inserted in.
2012   //
2013   // This is not strictly necessary, since we only ever look at the form number
2014   // for parser inserted form controls, and we do that at the time the form
2015   // control element is inserted into its original document by the parser.
2016   mFormNumber = -1;
2017 }
2018
2019 bool HTMLFormElement::IsSubmitting() const {
2020   bool loading = mTargetContext && !mTargetContext->IsDiscarded() &&
2021                  mCurrentLoadId &&
2022                  mTargetContext->IsLoadingIdentifier(*mCurrentLoadId);
2023   return loading;
2024 }
2025
2026 void HTMLFormElement::MaybeFireFormRemoved() {
2027   // We want this event to be fired only when the form is removed from the DOM
2028   // tree, not when it is released (ex, tab is closed). So don't fire an event
2029   // when the form doesn't have a docshell.
2030   Document* doc = GetComposedDoc();
2031   nsIDocShell* container = doc ? doc->GetDocShell() : nullptr;
2032   if (!container) {
2033     return;
2034   }
2035
2036   // Right now, only the password manager and formautofill listen to the event
2037   // and only listen to it under certain circumstances. So don't fire this event
2038   // unless necessary.
2039   if (!doc->ShouldNotifyFormOrPasswordRemoved()) {
2040     return;
2041   }
2042
2043   AsyncEventDispatcher::RunDOMEventWhenSafe(
2044       *this, u"DOMFormRemoved"_ns, CanBubble::eNo, ChromeOnlyDispatch::eYes);
2045 }
2046
2047 }  // namespace mozilla::dom