Render crash in FormManager::FindCachedFormElement()
To address the vulnerability of stale WebFrame pointers in the FormManager's cache this CL changes the cache from a map (with the WebFrame pointer as "key") to a flat vector of simplified "FormElement*" items.
To avoid leaking memory, we need to still observe |frameDetached|, and use that as a signal to reap any associated WebFormElements or WebFormControlElements.
BUG=48857
TEST=FormMananagerTest.*, and manual test of regular form filling, form filling a form with sub-iframes, and form filling a form with sub-frames.
Review URL: http://codereview.chromium.org/3492015
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@60949 0039d316-1c4b-4281-b951-d872f2087c98
2 files changed
