From 74df56e008bda162dcbdcb114ff1116f4ef65fe0 Mon Sep 17 00:00:00 2001
From: Kent Tamura <tkent@chromium.org>
Date: Tue, 14 May 2019 13:21:57 +0900
Subject: [PATCH] html: Add a testcase for submit event reentrancy protection

Specification: https://github.com/whatwg/html/pull/4621
---
 .../form-submission-algorithm.html            | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/html/semantics/forms/form-submission-0/form-submission-algorithm.html b/html/semantics/forms/form-submission-0/form-submission-algorithm.html
index bf9f9ce330a3a8f..bee000f0518805c 100644
--- a/html/semantics/forms/form-submission-0/form-submission-algorithm.html
+++ b/html/semantics/forms/form-submission-0/form-submission-algorithm.html
@@ -18,8 +18,25 @@
   assert_equals(counter, 2);
 }, 'If constructing entry list flag of form is true, then return');
 
-let test10 = async_test('Cannot navigate (after constructing the entry list)');
-test10.step(() => {
+
+async_test(t => {
+  let form = populateForm('<input type=hidden name=n value=v0><input type=submit>');
+  let submitter = form.querySelector('[type=submit]');
+  let iframe = form.previousSibling;
+  form.onsubmit = () => {
+    let hidden = form.querySelector('[type=hidden]');
+    hidden.value = 'inner click()';
+    submitter.click();
+    hidden.value = 'v2';
+  };
+  submitter.click();
+  iframe.onload = t.step_func_done(() => {
+    assert_not_equals(iframe.contentWindow.location.search.indexOf('n=v2'), -1);
+  });
+}, "If form's firing submit event is true, then return");
+
+let test9 = async_test('Cannot navigate (after constructing the entry list)');
+test9.step(() => {
   let form = populateForm('<input name=n1 value=v1>');
   form.onformdata = (e) => { e.target.remove(); };
   let wasLoaded = false;
@@ -27,7 +44,7 @@
   // Request to load '/common/dummy.xhtml', and immediately submit the form to
   // the same frame. If the form submission is aborted, the first request
   // will be completed.
-  iframe.onload = test10.step_func_done(() => {
+  iframe.onload = test9.step_func_done(() => {
     wasLoaded = true;
     assert_true(iframe.contentWindow.location.search.indexOf('n1=v1') == -1);
   });