Bug 1825745 - Make form submits do a replace load if they happen before document load has ended. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D174224

docshell/base/nsDocShell.cpp

@@ -975,6 +975,7 @@ bool nsDocShell::MaybeHandleSubframeHistory(
       // executing an onLoad Handler,this load will not go
       // into session history.
       // XXX Why is this code in a method which deals with iframes!
+      MOZ_ASSERT(!aLoadState->IsFormSubmission());
       bool inOnLoadHandler = false;
       GetIsExecutingOnLoadHandler(&inOnLoadHandler);
       if (inOnLoadHandler) {
@@ -13085,11 +13086,20 @@ nsresult nsDocShell::OnLinkClickSync(nsIContent* aContent,
     CopyUTF8toUTF16(type, typeHint);
   }
 
-  // Link click (or form submission) can be triggered inside an onload
-  // handler, and we don't want to add history entry in this case.
-  bool inOnLoadHandler = false;
-  GetIsExecutingOnLoadHandler(&inOnLoadHandler);
-  uint32_t loadType = inOnLoadHandler ? LOAD_NORMAL_REPLACE : LOAD_LINK;
+  uint32_t loadType;
+  if (aLoadState->IsFormSubmission()) {
+    // https://html.spec.whatwg.org/#form-submission-algorithm
+    //  22. Let historyHandling be "push".
+    //  23. If form document has not yet completely loaded, then set
+    //      historyHandling to "replace".
+    loadType = mEODForCurrentDocument ? LOAD_LINK : LOAD_NORMAL_REPLACE;
+  } else {
+    // Link click can be triggered inside an onload handler, and we don't want
+    // to add history entry in this case.
+    bool inOnLoadHandler = false;
+    GetIsExecutingOnLoadHandler(&inOnLoadHandler);
+    loadType = inOnLoadHandler ? LOAD_NORMAL_REPLACE : LOAD_LINK;
+  }
 
   nsCOMPtr<nsIReferrerInfo> referrerInfo =
       elementCanHaveNoopener ? new ReferrerInfo(*aContent->AsElement())

docshell/test/mochitest/file_bug1773192_2.html

@@ -7,7 +7,13 @@
     <form method="POST" action="file_bug1773192_3.sjs"></form>
     <script>
       history.replaceState({}, "", document.referrer);
-      document.forms[0].submit();
+      setTimeout(() => {
+        // The test relies on this page not going into the BFCache, so that
+        // when we come back to it we load the URL from the replaceState
+        // instead.
+        window.blockBFCache = new RTCPeerConnection();
+        document.forms[0].submit();
+      }, 0);
     </script>
   </body>
 </html>

testing/web-platform/meta/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-requestsubmit.html.ini

@@ -1,5 +1,3 @@
 [form-requestsubmit.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-  [Replace before load, triggered by formElement.requestSubmit()]
-    expected: FAIL

testing/web-platform/meta/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-button-click.html.ini

@@ -1,5 +1,3 @@
 [form-submit-button-click.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-  [Replace before load, triggered by submitButton.click()]
-    expected: FAIL

testing/web-platform/meta/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit.html.ini

@@ -1,5 +1,3 @@
 [form-submit.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-  [Replace before load, triggered by formElement.submit()]
-    expected: FAIL