Commit message: None
CVE: CVE-2017-5108
CWE: CWE-704
Vulnerability description: Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.

Project: Chrome

void HTMLFormControlElement::AssociateWith(HTMLFormElement* form) {
  AssociateByParser(form);
}

Project: Chrome

void HTMLFormControlElement::AttachLayoutTree(AttachContext& context) {
  HTMLElement::AttachLayoutTree(context);

  if (!GetLayoutObject())
    return;

  GetLayoutObject()->UpdateFromElement();
}

Project: Chrome

void HTMLFormControlElement::AttributeChanged(
    const AttributeModificationParams& params) {
  HTMLElement::AttributeChanged(params);
  if (params.name == kDisabledAttr &&
      params.old_value.IsNull() != params.new_value.IsNull()) {
    DisabledAttributeChanged();
    if (params.reason == AttributeModificationReason::kDirectly &&
        IsDisabledFormControl() && AdjustedFocusedElementInTreeScope() == this)
      blur();
  }
}

Project: Chrome

void HTMLFormControlElement::CloneNonAttributePropertiesFrom(
    const Element& source,
    CloneChildrenFlag flag) {
  HTMLElement::CloneNonAttributePropertiesFrom(source, flag);
  SetNeedsValidityCheck();
}

Project: Chrome

void HTMLFormControlElement::DidChangeForm() {
  ListedElement::DidChangeForm();
  if (formOwner() && isConnected() && CanBeSuccessfulSubmitButton())
    formOwner()->InvalidateDefaultButtonStyle();
}

Project: Chrome

void HTMLFormControlElement::DidMoveToNewDocument(Document& old_document) {
  ListedElement::DidMoveToNewDocument(old_document);
  HTMLElement::DidMoveToNewDocument(old_document);
}

Project: Chrome

void HTMLFormControlElement::DisabledAttributeChanged() {
  EventDispatchForbiddenScope event_forbidden;

  ListedElement::DisabledAttributeChanged();
  if (LayoutObject* o = GetLayoutObject())
    o->InvalidateIfControlStateChanged(kEnabledControlState);

  if (AXObjectCache* cache = GetDocument().ExistingAXObjectCache())
    cache->CheckedStateChanged(this);
}

Project: Chrome

void HTMLFormControlElement::DispatchChangeEvent() {
  DispatchScopedEvent(*Event::CreateBubble(event_type_names::kChange));
}

Project: Chrome

HTMLFormControlElement::EnclosingFormControlElement(const Node* node) {
  if (!node)
    return nullptr;
  return Traversal<HTMLFormControlElement>::FirstAncestorOrSelf(*node);
}

Project: Chrome

int32_t HTMLFormControlElement::GetAxId() const {
  if (AXObjectCache* cache = GetDocument().ExistingAXObjectCache())
    return cache->GetAXID(const_cast<HTMLFormControlElement*>(this));

  return 0;
}

Project: Chrome

HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tag_name,
                                               Document& document)
    : HTMLElement(tag_name, document),
      autofill_state_(WebAutofillState::kNotFilled),
      blocks_form_submission_(false) {
  SetHasCustomStyleCallbacks();
  static unsigned next_free_unique_id = 0;
  unique_renderer_form_control_id_ = next_free_unique_id++;
}

Project: Chrome

Node::InsertionNotificationRequest HTMLFormControlElement::InsertedInto(
    ContainerNode& insertion_point) {
  HTMLElement::InsertedInto(insertion_point);
  ListedElement::InsertedInto(insertion_point);

  if (ShouldAutofocus(this))
    GetDocument().TopDocument().EnqueueAutofocusCandidate(*this);
  return kInsertionDone;
}

Project: Chrome

bool HTMLFormControlElement::IsDisabledOrReadOnly() const {
  return IsDisabledFormControl() || IsReadOnly();
}

Project: Chrome

bool HTMLFormControlElement::IsKeyboardFocusable() const {
  if (RuntimeEnabledFeatures::FocuslessSpatialNavigationEnabled())
    return HTMLElement::IsKeyboardFocusable();

  return IsFocusable();
}

Project: Chrome

bool HTMLFormControlElement::IsReadOnly() const {
  return FastHasAttribute(html_names::kReadonlyAttr);
}

Project: Chrome

bool HTMLFormControlElement::IsRequired() const {
  return FastHasAttribute(kRequiredAttr);
}

Project: Chrome

bool HTMLFormControlElement::IsSuccessfulSubmitButton() const {
  return CanBeSuccessfulSubmitButton() && !IsDisabledFormControl();
}

Project: Chrome

bool HTMLFormControlElement::IsValidElement() {
  return ListedElement::IsValidElement();
}

Project: Chrome

bool HTMLFormControlElement::MatchesEnabledPseudoClass() const {
  return !IsDisabledFormControl();
}

Project: Chrome

bool HTMLFormControlElement::MatchesValidityPseudoClasses() const {
  return willValidate();
}

Project: Chrome

bool HTMLFormControlElement::MayTriggerVirtualKeyboard() const {
  return false;
}

Project: Chrome

String HTMLFormControlElement::NameForAutofill() const {
  String full_name = GetName();
  String trimmed_name = full_name.StripWhiteSpace();
  if (!trimmed_name.IsEmpty())
    return trimmed_name;
  full_name = GetIdAttribute();
  trimmed_name = full_name.StripWhiteSpace();
  return trimmed_name;
}

Project: Chrome

void HTMLFormControlElement::ParseAttribute(
    const AttributeModificationParams& params) {
  const QualifiedName& name = params.name;
  if (name == kFormAttr) {
    FormAttributeChanged();
    UseCounter::Count(GetDocument(), WebFeature::kFormAttribute);
  } else if (name == kReadonlyAttr) {
    if (params.old_value.IsNull() != params.new_value.IsNull()) {
      UpdateWillValidateCache();
      PseudoStateChanged(CSSSelector::kPseudoReadOnly);
      PseudoStateChanged(CSSSelector::kPseudoReadWrite);
      if (LayoutObject* o = GetLayoutObject())
        o->InvalidateIfControlStateChanged(kReadOnlyControlState);
    }
  } else if (name == kRequiredAttr) {
    if (params.old_value.IsNull() != params.new_value.IsNull())
      RequiredAttributeChanged();
    UseCounter::Count(GetDocument(), WebFeature::kRequiredAttribute);
  } else if (name == kAutofocusAttr) {
    HTMLElement::ParseAttribute(params);
    UseCounter::Count(GetDocument(), WebFeature::kAutoFocusAttribute);
  } else {
    HTMLElement::ParseAttribute(params);
  }
}

Project: Chrome

void HTMLFormControlElement::RemovedFrom(ContainerNode& insertion_point) {
  HTMLElement::RemovedFrom(insertion_point);
  ListedElement::RemovedFrom(insertion_point);
}

Project: Chrome

void HTMLFormControlElement::RequiredAttributeChanged() {
  SetNeedsValidityCheck();
  PseudoStateChanged(CSSSelector::kPseudoRequired);
  PseudoStateChanged(CSSSelector::kPseudoOptional);
  if (AXObjectCache* cache = GetDocument().ExistingAXObjectCache())
    cache->CheckedStateChanged(this);
}

Project: Chrome

void HTMLFormControlElement::Reset() {
  SetAutofillState(WebAutofillState::kNotFilled);
  ResetImpl();
}

Project: Chrome

String HTMLFormControlElement::ResultForDialogSubmit() {
  return FastGetAttribute(kValueAttr);
}

Project: Chrome

void HTMLFormControlElement::SetAutofillSection(const WebString& section) {
  autofill_section_ = section;
}

Project: Chrome

void HTMLFormControlElement::SetAutofillState(WebAutofillState autofill_state) {
  if (autofill_state == autofill_state_)
    return;

  autofill_state_ = autofill_state;
  PseudoStateChanged(CSSSelector::kPseudoAutofill);
  PseudoStateChanged(CSSSelector::kPseudoAutofillSelected);
  PseudoStateChanged(CSSSelector::kPseudoAutofillPreviewed);
}

Project: Chrome

bool HTMLFormControlElement::ShouldHaveFocusAppearance() const {
  return (GetDocument().LastFocusType() != kWebFocusTypeMouse) ||
         GetDocument().HadKeyboardEvent() || MayTriggerVirtualKeyboard();
}

Project: Chrome

bool HTMLFormControlElement::SupportsAutofocus() const {
  return false;
}

Project: Chrome

bool HTMLFormControlElement::SupportsFocus() const {
  return !IsDisabledFormControl();
}

Project: Chrome

void HTMLFormControlElement::Trace(Visitor* visitor) {
  ListedElement::Trace(visitor);
  HTMLElement::Trace(visitor);
}

Project: Chrome

void HTMLFormControlElement::WillChangeForm() {
  ListedElement::WillChangeForm();
  if (formOwner() && CanBeSuccessfulSubmitButton())
    formOwner()->InvalidateDefaultButtonStyle();
}

Project: Chrome

const AtomicString& HTMLFormControlElement::autocapitalize() const {
  if (!FastGetAttribute(kAutocapitalizeAttr).IsEmpty())
    return HTMLElement::autocapitalize();

  if (HTMLFormElement* form = Form())
    return form->autocapitalize();

  return g_empty_atom;
}

Project: Chrome

void HTMLFormControlElement::formAction(USVStringOrTrustedURL& result) const {
  const AtomicString& action = FastGetAttribute(kFormactionAttr);
  if (action.IsEmpty()) {
    result.SetUSVString(GetDocument().Url());
    return;
  }
  result.SetUSVString(
      GetDocument().CompleteURL(StripLeadingAndTrailingHTMLSpaces(action)));
}

Project: Chrome

String HTMLFormControlElement::formEnctype() const {
  const AtomicString& form_enctype_attr = FastGetAttribute(kFormenctypeAttr);
  if (form_enctype_attr.IsNull())
    return g_empty_string;
  return FormSubmission::Attributes::ParseEncodingType(form_enctype_attr);
}

Project: Chrome

String HTMLFormControlElement::formMethod() const {
  const AtomicString& form_method_attr = FastGetAttribute(kFormmethodAttr);
  if (form_method_attr.IsNull())
    return g_empty_string;
  return FormSubmission::Attributes::MethodString(
      FormSubmission::Attributes::ParseMethodType(form_method_attr));
}

Project: Chrome

HTMLFormElement* HTMLFormControlElement::formOwner() const {
  return ListedElement::Form();
}

Project: Chrome

void HTMLFormControlElement::setFormMethod(const AtomicString& value) {
  setAttribute(kFormmethodAttr, value);
}

Project: Chrome

int HTMLFormControlElement::tabIndex() const {
  return Element::tabIndex();
}

Project: Chrome

bool HTMLFormControlElement::willValidate() const {
  return ListedElement::WillValidate();
}