From 8c8cb3bc293dab0908706b6034aab1d2dcddd4e5 Mon Sep 17 00:00:00 2001
From: Florian Bruhin <git@the-compiler.org>
Date: Sun, 14 Jan 2018 20:20:51 +0100
Subject: [PATCH] Fix crash when clicking <form> element with name="value"
 child

https://stackoverflow.com/q/22942689/2085149

Fixes #2877
See #2569
---
 doc/changelog.asciidoc                    |  1 +
 qutebrowser/javascript/.eslintrc.yaml     |  2 +-
 qutebrowser/javascript/webelem.js         | 17 +++++++++++++++--
 tests/end2end/data/issue2569.html         |  4 ++++
 tests/end2end/features/javascript.feature |  6 ++++++
 5 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/doc/changelog.asciidoc b/doc/changelog.asciidoc
index 8c3a533a2..ac7b33ec8 100644
--- a/doc/changelog.asciidoc
+++ b/doc/changelog.asciidoc
@@ -136,6 +136,7 @@ Fixed
 - Fix crash when closing a tab immediately after hinting.
 - Worked around issues in Qt 5.10 with loading progress never being finished.
 - Fixed a crash when writing a flag before a command (e.g. `:-w open `).
+- Fixed a crash when clicking certain form elements with QtWebEngine.
 
 Deprecated
 ~~~~~~~~~~
diff --git a/qutebrowser/javascript/.eslintrc.yaml b/qutebrowser/javascript/.eslintrc.yaml
index 6fdd16639..2e4de98fc 100644
--- a/qutebrowser/javascript/.eslintrc.yaml
+++ b/qutebrowser/javascript/.eslintrc.yaml
@@ -33,7 +33,7 @@ rules:
      no-extra-parens: off
      id-length: ["error", {"exceptions": ["i", "k", "x", "y"]}]
      object-shorthand: "off"
-     max-statements: ["error", {"max": 30}]
+     max-statements: ["error", {"max": 40}]
      quotes: ["error", "double", {"avoidEscape": true}]
      object-property-newline: ["error", {"allowMultiplePropertiesPerLine": true}]
      comma-dangle: ["error", "always-multiline"]
diff --git a/qutebrowser/javascript/webelem.js b/qutebrowser/javascript/webelem.js
index b5fd936b2..61b537504 100644
--- a/qutebrowser/javascript/webelem.js
+++ b/qutebrowser/javascript/webelem.js
@@ -66,13 +66,14 @@ window._qutebrowser.webelem = (function() {
 
         const out = {
             "id": id,
-            "value": elem.value,
-            "outer_xml": elem.outerHTML,
             "rects": [],  // Gets filled up later
             "caret_position": caret_position,
         };
 
+        // Deal with various fun things which can happen in form elements
         // https://github.com/qutebrowser/qutebrowser/issues/2569
+        // https://github.com/qutebrowser/qutebrowser/issues/2877
+        // https://stackoverflow.com/q/22942689/2085149
         if (typeof elem.tagName === "string") {
             out.tag_name = elem.tagName;
         } else if (typeof elem.nodeName === "string") {
@@ -88,6 +89,18 @@ window._qutebrowser.webelem = (function() {
             out.class_name = "";
         }
 
+        if (typeof elem.value === "string" || typeof elem.value === "number") {
+            out.value = elem.value;
+        } else {
+            out.value = "";
+        }
+
+        if (typeof elem.outerHTML === "string") {
+            out.outer_xml = elem.outerHTML;
+        } else {
+            out.outer_xml = "";
+        }
+
         if (typeof elem.textContent === "string") {
             out.text = elem.textContent;
         } else if (typeof elem.text === "string") {
diff --git a/tests/end2end/data/issue2569.html b/tests/end2end/data/issue2569.html
index 8f613be2d..a21690bd6 100644
--- a/tests/end2end/data/issue2569.html
+++ b/tests/end2end/data/issue2569.html
@@ -15,6 +15,10 @@
         <form id="textform">
             <input name="text" type="text">
         </form>
+        <!-- Happens on the GitHub "new file" page -->
+        <form id="valueform">
+            <input name="value" type="text">
+        </form>
         <!-- Some regressions after we added type checking -->
         <svg xmlns="http://www.w3.org/2000/svg" width="30" height="20" viewBox="0 0 3 2" id="icon">
             <rect width="1" height="2" x="0" fill="#008d46" />
diff --git a/tests/end2end/features/javascript.feature b/tests/end2end/features/javascript.feature
index 3ccd50efb..c74811b4b 100644
--- a/tests/end2end/features/javascript.feature
+++ b/tests/end2end/features/javascript.feature
@@ -90,6 +90,12 @@ Feature: Javascript stuff
         And I wait for "Sending fake click to *" in the log
         Then no crash should happen
 
+    Scenario: Clicking on form element with value child
+        When I open data/issue2569.html
+        And I run :click-element id valueform
+        And I wait for "Sending fake click to *" in the log
+        Then no crash should happen
+
     Scenario: Clicking on svg element
         When I open data/issue2569.html
         And I run :click-element id icon