Add m-esr52 at 52.6.0

1 files changed, 2585 insertions, 0 deletions

diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp
new file mode 100644
index 000000000..5164391f8
--- /dev/null
+++ b/dom/html/HTMLFormElement.cpp
@@ -0,0 +1,2585 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/HTMLFormElement.h"
+
+#include "jsapi.h"
+#include "mozilla/ContentEvents.h"
+#include "mozilla/EventDispatcher.h"
+#include "mozilla/EventStateManager.h"
+#include "mozilla/EventStates.h"
+#include "mozilla/dom/AutocompleteErrorEvent.h"
+#include "mozilla/dom/nsCSPUtils.h"
+#include "mozilla/dom/nsCSPContext.h"
+#include "mozilla/dom/HTMLFormControlsCollection.h"
+#include "mozilla/dom/HTMLFormElementBinding.h"
+#include "mozilla/Move.h"
+#include "nsIHTMLDocument.h"
+#include "nsGkAtoms.h"
+#include "nsStyleConsts.h"
+#include "nsPresContext.h"
+#include "nsIDocument.h"
+#include "nsIFormControlFrame.h"
+#include "nsError.h"
+#include "nsContentUtils.h"
+#include "nsInterfaceHashtable.h"
+#include "nsContentList.h"
+#include "nsCOMArray.h"
+#include "nsAutoPtr.h"
+#include "nsTArray.h"
+#include "nsIMutableArray.h"
+#include "nsIFormAutofillContentService.h"
+#include "mozilla/BinarySearch.h"
+#include "nsQueryObject.h"
+
+// form submission
+#include "HTMLFormSubmissionConstants.h"
+#include "mozilla/dom/FormData.h"
+#include "mozilla/Telemetry.h"
+#include "nsIFormSubmitObserver.h"
+#include "nsIObserverService.h"
+#include "nsICategoryManager.h"
+#include "nsCategoryManagerUtils.h"
+#include "nsISimpleEnumerator.h"
+#include "nsRange.h"
+#include "nsIScriptError.h"
+#include "nsIScriptSecurityManager.h"
+#include "nsNetUtil.h"
+#include "nsIInterfaceRequestorUtils.h"
+#include "nsIWebProgress.h"
+#include "nsIDocShell.h"
+#include "nsIPrompt.h"
+#include "nsISecurityUITelemetry.h"
+#include "nsIStringBundle.h"
+
+// radio buttons
+#include "mozilla/dom/HTMLInputElement.h"
+#include "nsIRadioVisitor.h"
+#include "RadioNodeList.h"
+
+#include "nsLayoutUtils.h"
+
+#include "mozAutoDocUpdate.h"
+#include "nsIHTMLCollection.h"
+
+#include "nsIConstraintValidation.h"
+
+#include "nsIDOMHTMLButtonElement.h"
+#include "nsSandboxFlags.h"
+
+#include "nsIContentSecurityPolicy.h"
+
+// images
+#include "mozilla/dom/HTMLImageElement.h"
+
+// construction, destruction
+NS_IMPL_NS_NEW_HTML_ELEMENT(Form)
+
+namespace mozilla {
+namespace dom {
+
+static const uint8_t NS_FORM_AUTOCOMPLETE_ON  = 1;
+static const uint8_t NS_FORM_AUTOCOMPLETE_OFF = 0;
+
+static const nsAttrValue::EnumTable kFormAutocompleteTable[] = {
+  { "on",  NS_FORM_AUTOCOMPLETE_ON },
+  { "off", NS_FORM_AUTOCOMPLETE_OFF },
+  { nullptr, 0 }
+};
+// Default autocomplete value is 'on'.
+static const nsAttrValue::EnumTable* kFormDefaultAutocomplete = &kFormAutocompleteTable[0];
+
+bool HTMLFormElement::gFirstFormSubmitted = false;
+bool HTMLFormElement::gPasswordManagerInitialized = false;
+
+HTMLFormElement::HTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  : nsGenericHTMLElement(aNodeInfo),
+    mControls(new HTMLFormControlsCollection(this)),
+    mSelectedRadioButtons(2),
+    mRequiredRadioButtonCounts(2),
+    mValueMissingRadioGroups(2),
+    mGeneratingSubmit(false),
+    mGeneratingReset(false),
+    mIsSubmitting(false),
+    mDeferSubmission(false),
+    mNotifiedObservers(false),
+    mNotifiedObserversResult(false),
+    mSubmitPopupState(openAbused),
+    mSubmitInitiatedFromUserInput(false),
+    mPendingSubmission(nullptr),
+    mSubmittingRequest(nullptr),
+    mDefaultSubmitElement(nullptr),
+    mFirstSubmitInElements(nullptr),
+    mFirstSubmitNotInElements(nullptr),
+    mImageNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
+    mPastNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
+    mInvalidElementsCount(0),
+    mEverTriedInvalidSubmit(false)
+{
+  // We start out valid.
+  AddStatesSilently(NS_EVENT_STATE_VALID);
+}
+
+HTMLFormElement::~HTMLFormElement()
+{
+  if (mControls) {
+    mControls->DropFormReference();
+  }
+
+  Clear();
+}
+
+// nsISupports
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLFormElement)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLFormElement,
+                                                  nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControls)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mImageNameLookupTable)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPastNameLookupTable)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSelectedRadioButtons)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLFormElement,
+                                                nsGenericHTMLElement)
+  tmp->Clear();
+  tmp->mExpandoAndGeneration.OwnerUnlinked();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_ADDREF_INHERITED(HTMLFormElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLFormElement, Element)
+
+
+// QueryInterface implementation for HTMLFormElement
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(HTMLFormElement)
+  NS_INTERFACE_TABLE_INHERITED(HTMLFormElement,
+                               nsIDOMHTMLFormElement,
+                               nsIForm,
+                               nsIWebProgressListener,
+                               nsIRadioGroupContainer)
+NS_INTERFACE_TABLE_TAIL_INHERITING(nsGenericHTMLElement)
+
+// EventTarget
+void
+HTMLFormElement::AsyncEventRunning(AsyncEventDispatcher* aEvent)
+{
+  if (mFormPasswordEventDispatcher == aEvent) {
+    mFormPasswordEventDispatcher = nullptr;
+  }
+}
+
+// nsIDOMHTMLFormElement
+
+NS_IMPL_ELEMENT_CLONE(HTMLFormElement)
+
+nsIHTMLCollection*
+HTMLFormElement::Elements()
+{
+  return mControls;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::GetElements(nsIDOMHTMLCollection** aElements)
+{
+  *aElements = Elements();
+  NS_ADDREF(*aElements);
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                         nsIAtom* aPrefix, const nsAString& aValue,
+                         bool aNotify)
+{
+  if ((aName == nsGkAtoms::action || aName == nsGkAtoms::target) &&
+      aNameSpaceID == kNameSpaceID_None) {
+    if (mPendingSubmission) {
+      // aha, there is a pending submission that means we're in
+      // the script and we need to flush it. let's tell it
+      // that the event was ignored to force the flush.
+      // the second argument is not playing a role at all.
+      FlushPendingSubmission();
+    }
+    // Don't forget we've notified the password manager already if the
+    // page sets the action/target in the during submit. (bug 343182)
+    bool notifiedObservers = mNotifiedObservers;
+    ForgetCurrentSubmission();
+    mNotifiedObservers = notifiedObservers;
+  }
+  return nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix, aValue,
+                                       aNotify);
+}
+
+nsresult
+HTMLFormElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                              const nsAttrValue* aValue, bool aNotify)
+{
+  if (aName == nsGkAtoms::novalidate && aNameSpaceID == kNameSpaceID_None) {
+    // Update all form elements states because they might be [no longer]
+    // affected by :-moz-ui-valid or :-moz-ui-invalid.
+    for (uint32_t i = 0, length = mControls->mElements.Length();
+         i < length; ++i) {
+      mControls->mElements[i]->UpdateState(true);
+    }
+
+    for (uint32_t i = 0, length = mControls->mNotInElements.Length();
+         i < length; ++i) {
+      mControls->mNotInElements[i]->UpdateState(true);
+    }
+  }
+
+  return nsGenericHTMLElement::AfterSetAttr(aNameSpaceID, aName, aValue, aNotify);
+}
+
+NS_IMPL_STRING_ATTR(HTMLFormElement, AcceptCharset, acceptcharset)
+NS_IMPL_ACTION_ATTR(HTMLFormElement, Action, action)
+NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Autocomplete, autocomplete,
+                                kFormDefaultAutocomplete->tag)
+NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Enctype, enctype,
+                                kFormDefaultEnctype->tag)
+NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(HTMLFormElement, Method, method,
+                                kFormDefaultMethod->tag)
+NS_IMPL_BOOL_ATTR(HTMLFormElement, NoValidate, novalidate)
+NS_IMPL_STRING_ATTR(HTMLFormElement, Name, name)
+NS_IMPL_STRING_ATTR(HTMLFormElement, Target, target)
+
+void
+HTMLFormElement::Submit(ErrorResult& aRv)
+{
+  // Send the submit event
+  if (mPendingSubmission) {
+    // aha, we have a pending submission that was not flushed
+    // (this happens when form.submit() is called twice)
+    // we have to delete it and build a new one since values
+    // might have changed inbetween (we emulate IE here, that's all)
+    mPendingSubmission = nullptr;
+  }
+
+  aRv = DoSubmitOrReset(nullptr, eFormSubmit);
+}
+
+NS_IMETHODIMP
+HTMLFormElement::Submit()
+{
+  ErrorResult rv;
+  Submit(rv);
+  return rv.StealNSResult();
+}
+
+NS_IMETHODIMP
+HTMLFormElement::Reset()
+{
+  InternalFormEvent event(true, eFormReset);
+  EventDispatcher::Dispatch(static_cast<nsIContent*>(this), nullptr, &event);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::CheckValidity(bool* retVal)
+{
+  *retVal = CheckValidity();
+  return NS_OK;
+}
+
+void
+HTMLFormElement::RequestAutocomplete()
+{
+  bool dummy;
+  nsCOMPtr<nsIDOMWindow> window =
+    do_QueryInterface(OwnerDoc()->GetScriptHandlingObject(dummy));
+  nsCOMPtr<nsIFormAutofillContentService> formAutofillContentService =
+    do_GetService("@mozilla.org/formautofill/content-service;1");
+
+  if (!formAutofillContentService || !window) {
+    AutocompleteErrorEventInit init;
+    init.mBubbles = true;
+    init.mCancelable = false;
+    init.mReason = AutoCompleteErrorReason::Disabled;
+
+    RefPtr<AutocompleteErrorEvent> event =
+      AutocompleteErrorEvent::Constructor(this, NS_LITERAL_STRING("autocompleteerror"), init);
+
+    (new AsyncEventDispatcher(this, event))->PostDOMEvent();
+    return;
+  }
+
+  formAutofillContentService->RequestAutocomplete(this, window);
+}
+
+bool
+HTMLFormElement::ParseAttribute(int32_t aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult)
+{
+  if (aNamespaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::method) {
+      return aResult.ParseEnumValue(aValue, kFormMethodTable, false);
+    }
+    if (aAttribute == nsGkAtoms::enctype) {
+      return aResult.ParseEnumValue(aValue, kFormEnctypeTable, false);
+    }
+    if (aAttribute == nsGkAtoms::autocomplete) {
+      return aResult.ParseEnumValue(aValue, kFormAutocompleteTable, false);
+    }
+  }
+
+  return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
+                                              aResult);
+}
+
+nsresult
+HTMLFormElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                            nsIContent* aBindingParent,
+                            bool aCompileEventHandlers)
+{
+  nsresult rv = nsGenericHTMLElement::BindToTree(aDocument, aParent,
+                                                 aBindingParent,
+                                                 aCompileEventHandlers);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
+  if (htmlDoc) {
+    htmlDoc->AddedForm();
+  }
+
+  return rv;
+}
+
+template<typename T>
+static void
+MarkOrphans(const nsTArray<T*>& aArray)
+{
+  uint32_t length = aArray.Length();
+  for (uint32_t i = 0; i < length; ++i) {
+    aArray[i]->SetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
+  }
+}
+
+static void
+CollectOrphans(nsINode* aRemovalRoot,
+               const nsTArray<nsGenericHTMLFormElement*>& aArray
+#ifdef DEBUG
+               , nsIDOMHTMLFormElement* aThisForm
+#endif
+               )
+{
+  // Put a script blocker around all the notifications we're about to do.
+  nsAutoScriptBlocker scriptBlocker;
+
+  // Walk backwards so that if we remove elements we can just keep iterating
+  uint32_t length = aArray.Length();
+  for (uint32_t i = length; i > 0; --i) {
+    nsGenericHTMLFormElement* node = aArray[i-1];
+
+    // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
+    // node is in fact a descendant of the form and hence should stay in the
+    // form.  If it _is_ set, then we need to check whether the node is a
+    // descendant of aRemovalRoot.  If it is, we leave it in the form.
+#ifdef DEBUG
+    bool removed = false;
+#endif
+    if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) {
+      node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
+      if (!nsContentUtils::ContentIsDescendantOf(node, aRemovalRoot)) {
+        node->ClearForm(true);
+
+        // When a form control loses its form owner, its state can change.
+        node->UpdateState(true);
+#ifdef DEBUG
+        removed = true;
+#endif
+      }
+    }
+
+#ifdef DEBUG
+    if (!removed) {
+      nsCOMPtr<nsIDOMHTMLFormElement> form;
+      node->GetForm(getter_AddRefs(form));
+      NS_ASSERTION(form == aThisForm, "How did that happen?");
+    }
+#endif /* DEBUG */
+  }
+}
+
+static void
+CollectOrphans(nsINode* aRemovalRoot,
+               const nsTArray<HTMLImageElement*>& aArray
+#ifdef DEBUG
+               , nsIDOMHTMLFormElement* aThisForm
+#endif
+               )
+{
+  // Walk backwards so that if we remove elements we can just keep iterating
+  uint32_t length = aArray.Length();
+  for (uint32_t i = length; i > 0; --i) {
+    HTMLImageElement* node = aArray[i-1];
+
+    // Now if MAYBE_ORPHAN_FORM_ELEMENT is not set, that would mean that the
+    // node is in fact a descendant of the form and hence should stay in the
+    // form.  If it _is_ set, then we need to check whether the node is a
+    // descendant of aRemovalRoot.  If it is, we leave it in the form.
+#ifdef DEBUG
+    bool removed = false;
+#endif
+    if (node->HasFlag(MAYBE_ORPHAN_FORM_ELEMENT)) {
+      node->UnsetFlags(MAYBE_ORPHAN_FORM_ELEMENT);
+      if (!nsContentUtils::ContentIsDescendantOf(node, aRemovalRoot)) {
+        node->ClearForm(true);
+
+#ifdef DEBUG
+        removed = true;
+#endif
+      }
+    }
+
+#ifdef DEBUG
+    if (!removed) {
+      nsCOMPtr<nsIDOMHTMLFormElement> form = node->GetForm();
+      NS_ASSERTION(form == aThisForm, "How did that happen?");
+    }
+#endif /* DEBUG */
+  }
+}
+
+void
+HTMLFormElement::UnbindFromTree(bool aDeep, bool aNullParent)
+{
+  nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetUncomposedDoc());
+
+  // Mark all of our controls as maybe being orphans
+  MarkOrphans(mControls->mElements);
+  MarkOrphans(mControls->mNotInElements);
+  MarkOrphans(mImageElements);
+
+  nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
+
+  nsINode* ancestor = this;
+  nsINode* cur;
+  do {
+    cur = ancestor->GetParentNode();
+    if (!cur) {
+      break;
+    }
+    ancestor = cur;
+  } while (1);
+
+  CollectOrphans(ancestor, mControls->mElements
+#ifdef DEBUG
+                 , this
+#endif
+                 );
+  CollectOrphans(ancestor, mControls->mNotInElements
+#ifdef DEBUG
+                 , this
+#endif
+                 );
+  CollectOrphans(ancestor, mImageElements
+#ifdef DEBUG
+                 , this
+#endif
+                 );
+
+  if (oldDocument) {
+    oldDocument->RemovedForm();
+  }
+  ForgetCurrentSubmission();
+}
+
+nsresult
+HTMLFormElement::PreHandleEvent(EventChainPreVisitor& aVisitor)
+{
+  aVisitor.mWantsWillHandleEvent = true;
+  if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this)) {
+    uint32_t msg = aVisitor.mEvent->mMessage;
+    if (msg == eFormSubmit) {
+      if (mGeneratingSubmit) {
+        aVisitor.mCanHandle = false;
+        return NS_OK;
+      }
+      mGeneratingSubmit = true;
+
+      // let the form know that it needs to defer the submission,
+      // that means that if there are scripted submissions, the
+      // latest one will be deferred until after the exit point of the handler.
+      mDeferSubmission = true;
+    } else if (msg == eFormReset) {
+      if (mGeneratingReset) {
+        aVisitor.mCanHandle = false;
+        return NS_OK;
+      }
+      mGeneratingReset = true;
+    }
+  }
+  return nsGenericHTMLElement::PreHandleEvent(aVisitor);
+}
+
+nsresult
+HTMLFormElement::WillHandleEvent(EventChainPostVisitor& aVisitor)
+{
+  // If this is the bubble stage and there is a nested form below us which
+  // received a submit event we do *not* want to handle the submit event
+  // for this form too.
+  if ((aVisitor.mEvent->mMessage == eFormSubmit ||
+       aVisitor.mEvent->mMessage == eFormReset) &&
+      aVisitor.mEvent->mFlags.mInBubblingPhase &&
+      aVisitor.mEvent->mOriginalTarget != static_cast<nsIContent*>(this)) {
+    aVisitor.mEvent->StopPropagation();
+  }
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::PostHandleEvent(EventChainPostVisitor& aVisitor)
+{
+  if (aVisitor.mEvent->mOriginalTarget == static_cast<nsIContent*>(this)) {
+    EventMessage msg = aVisitor.mEvent->mMessage;
+    if (msg == eFormSubmit) {
+      // let the form know not to defer subsequent submissions
+      mDeferSubmission = false;
+    }
+
+    if (aVisitor.mEventStatus == nsEventStatus_eIgnore) {
+      switch (msg) {
+        case eFormReset:
+        case eFormSubmit: {
+          if (mPendingSubmission && msg == eFormSubmit) {
+            // tell the form to forget a possible pending submission.
+            // the reason is that the script returned true (the event was
+            // ignored) so if there is a stored submission, it will miss
+            // the name/value of the submitting element, thus we need
+            // to forget it and the form element will build a new one
+            mPendingSubmission = nullptr;
+          }
+          DoSubmitOrReset(aVisitor.mEvent, msg);
+          break;
+        }
+        default:
+          break;
+      }
+    } else {
+      if (msg == eFormSubmit) {
+        // tell the form to flush a possible pending submission.
+        // the reason is that the script returned false (the event was
+        // not ignored) so if there is a stored submission, it needs to
+        // be submitted immediatelly.
+        FlushPendingSubmission();
+      }
+    }
+
+    if (msg == eFormSubmit) {
+      mGeneratingSubmit = false;
+    } else if (msg == eFormReset) {
+      mGeneratingReset = false;
+    }
+  }
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::DoSubmitOrReset(WidgetEvent* aEvent,
+                                 EventMessage aMessage)
+{
+  // Make sure the presentation is up-to-date
+  nsIDocument* doc = GetComposedDoc();
+  if (doc) {
+    doc->FlushPendingNotifications(Flush_ContentAndNotify);
+  }
+
+  // JBK Don't get form frames anymore - bug 34297
+
+  // Submit or Reset the form
+  if (eFormReset == aMessage) {
+    return DoReset();
+  }
+
+  if (eFormSubmit == aMessage) {
+    // Don't submit if we're not in a document or if we're in
+    // a sandboxed frame and form submit is disabled.
+    if (!doc || (doc->GetSandboxFlags() & SANDBOXED_FORMS)) {
+      return NS_OK;
+    }
+    return DoSubmit(aEvent);
+  }
+
+  MOZ_ASSERT(false);
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::DoReset()
+{
+  // JBK walk the elements[] array instead of form frame controls - bug 34297
+  uint32_t numElements = GetElementCount();
+  for (uint32_t elementX = 0; elementX < numElements; ++elementX) {
+    // Hold strong ref in case the reset does something weird
+    nsCOMPtr<nsIFormControl> controlNode = GetElementAt(elementX);
+    if (controlNode) {
+      controlNode->Reset();
+    }
+  }
+
+  return NS_OK;
+}
+
+#define NS_ENSURE_SUBMIT_SUCCESS(rv)                                          \
+  if (NS_FAILED(rv)) {                                                        \
+    ForgetCurrentSubmission();                                                \
+    return rv;                                                                \
+  }
+
+nsresult
+HTMLFormElement::DoSubmit(WidgetEvent* aEvent)
+{
+  NS_ASSERTION(GetComposedDoc(), "Should never get here without a current doc");
+
+  if (mIsSubmitting) {
+    NS_WARNING("Preventing double form submission");
+    // XXX Should this return an error?
+    return NS_OK;
+  }
+
+  // Mark us as submitting so that we don't try to submit again
+  mIsSubmitting = true;
+  NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!");
+
+  nsAutoPtr<HTMLFormSubmission> submission;
+
+  //
+  // prepare the submission object
+  //
+  nsresult rv = BuildSubmission(getter_Transfers(submission), aEvent);
+  if (NS_FAILED(rv)) {
+    mIsSubmitting = false;
+    return rv;
+  }
+
+  // XXXbz if the script global is that for an sXBL/XBL2 doc, it won't
+  // be a window...
+  nsPIDOMWindowOuter *window = OwnerDoc()->GetWindow();
+
+  if (window) {
+    mSubmitPopupState = window->GetPopupControlState();
+  } else {
+    mSubmitPopupState = openAbused;
+  }
+
+  mSubmitInitiatedFromUserInput = EventStateManager::IsHandlingUserInput();
+
+  if(mDeferSubmission) {
+    // we are in an event handler, JS submitted so we have to
+    // defer this submission. let's remember it and return
+    // without submitting
+    mPendingSubmission = submission;
+    // ensure reentrancy
+    mIsSubmitting = false;
+    return NS_OK;
+  }
+
+  //
+  // perform the submission
+  //
+  return SubmitSubmission(submission);
+}
+
+nsresult
+HTMLFormElement::BuildSubmission(HTMLFormSubmission** aFormSubmission,
+                                 WidgetEvent* aEvent)
+{
+  NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!");
+
+  // Get the originating frame (failure is non-fatal)
+  nsGenericHTMLElement* originatingElement = nullptr;
+  if (aEvent) {
+    InternalFormEvent* formEvent = aEvent->AsFormEvent();
+    if (formEvent) {
+      nsIContent* originator = formEvent->mOriginator;
+      if (originator) {
+        if (!originator->IsHTMLElement()) {
+          return NS_ERROR_UNEXPECTED;
+        }
+        originatingElement = static_cast<nsGenericHTMLElement*>(originator);
+      }
+    }
+  }
+
+  nsresult rv;
+
+  //
+  // Get the submission object
+  //
+  rv = HTMLFormSubmission::GetFromForm(this, originatingElement,
+                                       aFormSubmission);
+  NS_ENSURE_SUBMIT_SUCCESS(rv);
+
+  //
+  // Dump the data into the submission object
+  //
+  rv = WalkFormElements(*aFormSubmission);
+  NS_ENSURE_SUBMIT_SUCCESS(rv);
+
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::SubmitSubmission(HTMLFormSubmission* aFormSubmission)
+{
+  nsresult rv;
+  nsIContent* originatingElement = aFormSubmission->GetOriginatingElement();
+
+  //
+  // Get the action and target
+  //
+  nsCOMPtr<nsIURI> actionURI;
+  rv = GetActionURL(getter_AddRefs(actionURI), originatingElement);
+  NS_ENSURE_SUBMIT_SUCCESS(rv);
+
+  if (!actionURI) {
+    mIsSubmitting = false;
+    return NS_OK;
+  }
+
+  // If there is no link handler, then we won't actually be able to submit.
+  nsIDocument* doc = GetComposedDoc();
+  nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nullptr;
+  nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container));
+  if (!linkHandler || IsEditable()) {
+    mIsSubmitting = false;
+    return NS_OK;
+  }
+
+  // javascript URIs are not really submissions; they just call a function.
+  // Also, they may synchronously call submit(), and we want them to be able to
+  // do so while still disallowing other double submissions. (Bug 139798)
+  // Note that any other URI types that are of equivalent type should also be
+  // added here.
+  // XXXbz this is a mess.  The real issue here is that nsJSChannel sets the
+  // LOAD_BACKGROUND flag, so doesn't notify us, compounded by the fact that
+  // the JS executes before we forget the submission in OnStateChange on
+  // STATE_STOP.  As a result, we have to make sure that we simply pretend
+  // we're not submitting when submitting to a JS URL.  That's kinda bogus, but
+  // there we are.
+  bool schemeIsJavaScript = false;
+  if (NS_SUCCEEDED(actionURI->SchemeIs("javascript", &schemeIsJavaScript)) &&
+      schemeIsJavaScript) {
+    mIsSubmitting = false;
+  }
+
+  // The target is the originating element formtarget attribute if the element
+  // is a submit control and has such an attribute.
+  // Otherwise, the target is the form owner's target attribute,
+  // if it has such an attribute.
+  // Finally, if one of the child nodes of the head element is a base element
+  // with a target attribute, then the value of the target attribute of the
+  // first such base element; or, if there is no such element, the empty string.
+  nsAutoString target;
+  if (!(originatingElement && originatingElement->GetAttr(kNameSpaceID_None,
+                                                          nsGkAtoms::formtarget,
+                                                          target)) &&
+      !GetAttr(kNameSpaceID_None, nsGkAtoms::target, target)) {
+    GetBaseTarget(target);
+  }
+
+  //
+  // Notify observers of submit
+  //
+  bool cancelSubmit = false;
+  if (mNotifiedObservers) {
+    cancelSubmit = mNotifiedObserversResult;
+  } else {
+    rv = NotifySubmitObservers(actionURI, &cancelSubmit, true);
+    NS_ENSURE_SUBMIT_SUCCESS(rv);
+  }
+
+  if (cancelSubmit) {
+    mIsSubmitting = false;
+    return NS_OK;
+  }
+
+  cancelSubmit = false;
+  rv = NotifySubmitObservers(actionURI, &cancelSubmit, false);
+  NS_ENSURE_SUBMIT_SUCCESS(rv);
+
+  if (cancelSubmit) {
+    mIsSubmitting = false;
+    return NS_OK;
+  }
+
+  //
+  // Submit
+  //
+  nsCOMPtr<nsIDocShell> docShell;
+
+  {
+    nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState);
+
+    AutoHandlingUserInputStatePusher userInpStatePusher(
+                                       mSubmitInitiatedFromUserInput,
+                                       nullptr, doc);
+
+    nsCOMPtr<nsIInputStream> postDataStream;
+    rv = aFormSubmission->GetEncodedSubmission(actionURI,
+                                               getter_AddRefs(postDataStream));
+    NS_ENSURE_SUBMIT_SUCCESS(rv);
+
+    rv = linkHandler->OnLinkClickSync(this, actionURI,
+                                      target.get(),
+                                      NullString(),
+                                      postDataStream, nullptr,
+                                      getter_AddRefs(docShell),
+                                      getter_AddRefs(mSubmittingRequest));
+    NS_ENSURE_SUBMIT_SUCCESS(rv);
+  }
+
+  // Even if the submit succeeds, it's possible for there to be no docshell
+  // or request; for example, if it's to a named anchor within the same page
+  // the submit will not really do anything.
+  if (docShell) {
+    // If the channel is pending, we have to listen for web progress.
+    bool pending = false;
+    mSubmittingRequest->IsPending(&pending);
+    if (pending && !schemeIsJavaScript) {
+      nsCOMPtr<nsIWebProgress> webProgress = do_GetInterface(docShell);
+      NS_ASSERTION(webProgress, "nsIDocShell not converted to nsIWebProgress!");
+      rv = webProgress->AddProgressListener(this, nsIWebProgress::NOTIFY_STATE_ALL);
+      NS_ENSURE_SUBMIT_SUCCESS(rv);
+      mWebProgress = do_GetWeakReference(webProgress);
+      NS_ASSERTION(mWebProgress, "can't hold weak ref to webprogress!");
+    } else {
+      ForgetCurrentSubmission();
+    }
+  } else {
+    ForgetCurrentSubmission();
+  }
+
+  return rv;
+}
+
+nsresult
+HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI* aActionURL,
+                                               bool* aCancelSubmit)
+{
+  *aCancelSubmit = false;
+
+  // Only ask the user about posting from a secure URI to an insecure URI if
+  // this element is in the root document. When this is not the case, the mixed
+  // content blocker will take care of security for us.
+  nsIDocument* parent = OwnerDoc()->GetParentDocument();
+  bool isRootDocument = (!parent || nsContentUtils::IsChromeDoc(parent));
+  if (!isRootDocument) {
+    return NS_OK;
+  }
+
+  nsIPrincipal* principal = NodePrincipal();
+  if (!principal) {
+    *aCancelSubmit = true;
+    return NS_OK;
+  }
+  nsCOMPtr<nsIURI> principalURI;
+  nsresult rv = principal->GetURI(getter_AddRefs(principalURI));
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  if (!principalURI) {
+    principalURI = OwnerDoc()->GetDocumentURI();
+  }
+  bool formIsHTTPS;
+  rv = principalURI->SchemeIs("https", &formIsHTTPS);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  bool actionIsHTTPS;
+  rv = aActionURL->SchemeIs("https", &actionIsHTTPS);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  bool actionIsJS;
+  rv = aActionURL->SchemeIs("javascript", &actionIsJS);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  if (!formIsHTTPS || actionIsHTTPS || actionIsJS) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow();
+  if (!window) {
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIDocShell> docShell = window->GetDocShell();
+  if (!docShell) {
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIPrompt> prompt = do_GetInterface(docShell);
+  if (!prompt) {
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIStringBundle> stringBundle;
+  nsCOMPtr<nsIStringBundleService> stringBundleService =
+    mozilla::services::GetStringBundleService();
+  if (!stringBundleService) {
+    return NS_ERROR_FAILURE;
+  }
+  rv = stringBundleService->CreateBundle(
+    "chrome://global/locale/browser.properties",
+    getter_AddRefs(stringBundle));
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  nsAutoString title;
+  nsAutoString message;
+  nsAutoString cont;
+  stringBundle->GetStringFromName(
+    u"formPostSecureToInsecureWarning.title", getter_Copies(title));
+  stringBundle->GetStringFromName(
+    u"formPostSecureToInsecureWarning.message",
+    getter_Copies(message));
+  stringBundle->GetStringFromName(
+    u"formPostSecureToInsecureWarning.continue",
+    getter_Copies(cont));
+  int32_t buttonPressed;
+  bool checkState = false; // this is unused (ConfirmEx requires this parameter)
+  rv = prompt->ConfirmEx(title.get(), message.get(),
+                         (nsIPrompt::BUTTON_TITLE_IS_STRING *
+                          nsIPrompt::BUTTON_POS_0) +
+                         (nsIPrompt::BUTTON_TITLE_CANCEL *
+                          nsIPrompt::BUTTON_POS_1),
+                         cont.get(), nullptr, nullptr, nullptr,
+                            &checkState, &buttonPressed);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  *aCancelSubmit = (buttonPressed == 1);
+  uint32_t telemetryBucket =
+    nsISecurityUITelemetry::WARNING_CONFIRM_POST_TO_INSECURE_FROM_SECURE;
+  mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI,
+                                 telemetryBucket);
+  if (!*aCancelSubmit) {
+    // The user opted to continue, so note that in the next telemetry bucket.
+    mozilla::Telemetry::Accumulate(mozilla::Telemetry::SECURITY_UI,
+                                   telemetryBucket + 1);
+  }
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::NotifySubmitObservers(nsIURI* aActionURL,
+                                       bool* aCancelSubmit,
+                                       bool    aEarlyNotify)
+{
+  // If this is the first form, bring alive the first form submit
+  // category observers
+  if (!gFirstFormSubmitted) {
+    gFirstFormSubmitted = true;
+    NS_CreateServicesFromCategory(NS_FIRST_FORMSUBMIT_CATEGORY,
+                                  nullptr,
+                                  NS_FIRST_FORMSUBMIT_CATEGORY);
+  }
+
+  if (!aEarlyNotify) {
+    nsresult rv = DoSecureToInsecureSubmitCheck(aActionURL, aCancelSubmit);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    if (*aCancelSubmit) {
+      return NS_OK;
+    }
+  }
+
+  // Notify observers that the form is being submitted.
+  nsCOMPtr<nsIObserverService> service =
+    mozilla::services::GetObserverService();
+  if (!service)
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsISimpleEnumerator> theEnum;
+  nsresult rv = service->EnumerateObservers(aEarlyNotify ?
+                                            NS_EARLYFORMSUBMIT_SUBJECT :
+                                            NS_FORMSUBMIT_SUBJECT,
+                                            getter_AddRefs(theEnum));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (theEnum) {
+    nsCOMPtr<nsISupports> inst;
+    *aCancelSubmit = false;
+
+    // XXXbz what do the submit observers actually want?  The window
+    // of the document this is shown in?  Or something else?
+    // sXBL/XBL2 issue
+    nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow();
+
+    bool loop = true;
+    while (NS_SUCCEEDED(theEnum->HasMoreElements(&loop)) && loop) {
+      theEnum->GetNext(getter_AddRefs(inst));
+
+      nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver(
+                      do_QueryInterface(inst));
+      if (formSubmitObserver) {
+        rv = formSubmitObserver->Notify(this,
+                                        window ? window->GetCurrentInnerWindow() : nullptr,
+                                        aActionURL,
+                                        aCancelSubmit);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+      if (*aCancelSubmit) {
+        return NS_OK;
+      }
+    }
+  }
+
+  return rv;
+}
+
+
+nsresult
+HTMLFormElement::WalkFormElements(HTMLFormSubmission* aFormSubmission)
+{
+  nsTArray<nsGenericHTMLFormElement*> sortedControls;
+  nsresult rv = mControls->GetSortedControls(sortedControls);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uint32_t len = sortedControls.Length();
+
+  // Hold a reference to the elements so they can't be deleted while
+  // calling SubmitNamesValues().
+  for (uint32_t i = 0; i < len; ++i) {
+    static_cast<nsGenericHTMLElement*>(sortedControls[i])->AddRef();
+  }
+
+  //
+  // Walk the list of nodes and call SubmitNamesValues() on the controls
+  //
+  for (uint32_t i = 0; i < len; ++i) {
+    // Tell the control to submit its name/value pairs to the submission
+    sortedControls[i]->SubmitNamesValues(aFormSubmission);
+  }
+
+  // Release the references.
+  for (uint32_t i = 0; i < len; ++i) {
+    static_cast<nsGenericHTMLElement*>(sortedControls[i])->Release();
+  }
+
+  return NS_OK;
+}
+
+// nsIForm
+
+NS_IMETHODIMP_(uint32_t)
+HTMLFormElement::GetElementCount() const
+{
+  uint32_t count = 0;
+  mControls->GetLength(&count);
+  return count;
+}
+
+Element*
+HTMLFormElement::IndexedGetter(uint32_t aIndex, bool &aFound)
+{
+  Element* element = mControls->mElements.SafeElementAt(aIndex, nullptr);
+  aFound = element != nullptr;
+  return element;
+}
+
+NS_IMETHODIMP_(nsIFormControl*)
+HTMLFormElement::GetElementAt(int32_t aIndex) const
+{
+  return mControls->mElements.SafeElementAt(aIndex, nullptr);
+}
+
+/**
+ * Compares the position of aControl1 and aControl2 in the document
+ * @param aControl1 First control to compare.
+ * @param aControl2 Second control to compare.
+ * @param aForm Parent form of the controls.
+ * @return < 0 if aControl1 is before aControl2,
+ *         > 0 if aControl1 is after aControl2,
+ *         0 otherwise
+ */
+/* static */ int32_t
+HTMLFormElement::CompareFormControlPosition(Element* aElement1,
+                                            Element* aElement2,
+                                            const nsIContent* aForm)
+{
+  NS_ASSERTION(aElement1 != aElement2, "Comparing a form control to itself");
+
+  // If an element has a @form, we can assume it *might* be able to not have
+  // a parent and still be in the form.
+  NS_ASSERTION((aElement1->HasAttr(kNameSpaceID_None, nsGkAtoms::form) ||
+                aElement1->GetParent()) &&
+               (aElement2->HasAttr(kNameSpaceID_None, nsGkAtoms::form) ||
+                aElement2->GetParent()),
+               "Form controls should always have parents");
+
+  // If we pass aForm, we are assuming both controls are form descendants which
+  // is not always the case. This function should work but maybe slower.
+  // However, checking if both elements are form descendants may be slow too...
+  // TODO: remove the prevent asserts fix, see bug 598468.
+#ifdef DEBUG
+  nsLayoutUtils::gPreventAssertInCompareTreePosition = true;
+  int32_t rVal = nsLayoutUtils::CompareTreePosition(aElement1, aElement2, aForm);
+  nsLayoutUtils::gPreventAssertInCompareTreePosition = false;
+
+  return rVal;
+#else // DEBUG
+  return nsLayoutUtils::CompareTreePosition(aElement1, aElement2, aForm);
+#endif // DEBUG
+}
+
+#ifdef DEBUG
+/**
+ * Checks that all form elements are in document order. Asserts if any pair of
+ * consecutive elements are not in increasing document order.
+ *
+ * @param aControls List of form controls to check.
+ * @param aForm Parent form of the controls.
+ */
+/* static */ void
+HTMLFormElement::AssertDocumentOrder(
+  const nsTArray<nsGenericHTMLFormElement*>& aControls, nsIContent* aForm)
+{
+  // TODO: remove the return statement with bug 598468.
+  // This is done to prevent asserts in some edge cases.
+  return;
+
+  // Only iterate if aControls is not empty, since otherwise
+  // |aControls.Length() - 1| will be a very large unsigned number... not what
+  // we want here.
+  if (!aControls.IsEmpty()) {
+    for (uint32_t i = 0; i < aControls.Length() - 1; ++i) {
+      NS_ASSERTION(CompareFormControlPosition(aControls[i], aControls[i + 1],
+                                              aForm) < 0,
+                   "Form controls not ordered correctly");
+    }
+  }
+}
+#endif
+
+void
+HTMLFormElement::PostPasswordEvent()
+{
+  // Don't fire another add event if we have a pending add event.
+  if (mFormPasswordEventDispatcher.get()) {
+    return;
+  }
+
+  mFormPasswordEventDispatcher =
+    new AsyncEventDispatcher(this, NS_LITERAL_STRING("DOMFormHasPassword"),
+                             true, true);
+  mFormPasswordEventDispatcher->PostDOMEvent();
+}
+
+namespace {
+
+struct FormComparator
+{
+  Element* const mChild;
+  HTMLFormElement* const mForm;
+  FormComparator(Element* aChild, HTMLFormElement* aForm)
+    : mChild(aChild), mForm(aForm) {}
+  int operator()(Element* aElement) const {
+    return HTMLFormElement::CompareFormControlPosition(mChild, aElement, mForm);
+  }
+};
+
+} // namespace
+
+// This function return true if the element, once appended, is the last one in
+// the array.
+template<typename ElementType>
+static bool
+AddElementToList(nsTArray<ElementType*>& aList, ElementType* aChild,
+                 HTMLFormElement* aForm)
+{
+  NS_ASSERTION(aList.IndexOf(aChild) == aList.NoIndex,
+               "aChild already in aList");
+
+  const uint32_t count = aList.Length();
+  ElementType* element;
+  bool lastElement = false;
+
+  // Optimize most common case where we insert at the end.
+  int32_t position = -1;
+  if (count > 0) {
+    element = aList[count - 1];
+    position =
+      HTMLFormElement::CompareFormControlPosition(aChild, element, aForm);
+  }
+
+  // If this item comes after the last element, or the elements array is
+  // empty, we append to the end. Otherwise, we do a binary search to
+  // determine where the element should go.
+  if (position >= 0 || count == 0) {
+    // WEAK - don't addref
+    aList.AppendElement(aChild);
+    lastElement = true;
+  }
+  else {
+    size_t idx;
+    BinarySearchIf(aList, 0, count, FormComparator(aChild, aForm), &idx);
+
+    // WEAK - don't addref
+    aList.InsertElementAt(idx, aChild);
+  }
+
+  return lastElement;
+}
+
+nsresult
+HTMLFormElement::AddElement(nsGenericHTMLFormElement* aChild,
+                            bool aUpdateValidity, bool aNotify)
+{
+  // If an element has a @form, we can assume it *might* be able to not have
+  // a parent and still be in the form.
+  NS_ASSERTION(aChild->HasAttr(kNameSpaceID_None, nsGkAtoms::form) ||
+               aChild->GetParent(),
+               "Form control should have a parent");
+
+  // Determine whether to add the new element to the elements or
+  // the not-in-elements list.
+  bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(aChild);
+  nsTArray<nsGenericHTMLFormElement*>& controlList = childInElements ?
+      mControls->mElements : mControls->mNotInElements;
+
+  bool lastElement = AddElementToList(controlList, aChild, this);
+
+#ifdef DEBUG
+  AssertDocumentOrder(controlList, this);
+#endif
+
+  int32_t type = aChild->GetType();
+
+  //
+  // If it is a password control, and the password manager has not yet been
+  // initialized, initialize the password manager
+  //
+  if (type == NS_FORM_INPUT_PASSWORD) {
+    if (!gPasswordManagerInitialized) {
+      gPasswordManagerInitialized = true;
+      NS_CreateServicesFromCategory(NS_PASSWORDMANAGER_CATEGORY,
+                                    nullptr,
+                                    NS_PASSWORDMANAGER_CATEGORY);
+    }
+    PostPasswordEvent();
+  }
+
+  // Default submit element handling
+  if (aChild->IsSubmitControl()) {
+    // Update mDefaultSubmitElement, mFirstSubmitInElements,
+    // mFirstSubmitNotInElements.
+
+    nsGenericHTMLFormElement** firstSubmitSlot =
+      childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
+
+    // The new child is the new first submit in its list if the firstSubmitSlot
+    // is currently empty or if the child is before what's currently in the
+    // slot.  Note that if we already have a control in firstSubmitSlot and
+    // we're appending this element can't possibly replace what's currently in
+    // the slot.  Also note that aChild can't become the mDefaultSubmitElement
+    // unless it replaces what's in the slot.  If it _does_ replace what's in
+    // the slot, it becomes the default submit if either the default submit is
+    // what's in the slot or the child is earlier than the default submit.
+    nsGenericHTMLFormElement* oldDefaultSubmit = mDefaultSubmitElement;
+    if (!*firstSubmitSlot ||
+        (!lastElement &&
+         CompareFormControlPosition(aChild, *firstSubmitSlot, this) < 0)) {
+      // Update mDefaultSubmitElement if it's currently in a valid state.
+      // Valid state means either non-null or null because there are in fact
+      // no submit elements around.
+      if ((mDefaultSubmitElement ||
+           (!mFirstSubmitInElements && !mFirstSubmitNotInElements)) &&
+          (*firstSubmitSlot == mDefaultSubmitElement ||
+           CompareFormControlPosition(aChild,
+                                      mDefaultSubmitElement, this) < 0)) {
+        mDefaultSubmitElement = aChild;
+      }
+      *firstSubmitSlot = aChild;
+    }
+    NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements ||
+                     mDefaultSubmitElement == mFirstSubmitNotInElements ||
+                     !mDefaultSubmitElement,
+                     "What happened here?");
+
+    // Notify that the state of the previous default submit element has changed
+    // if the element which is the default submit element has changed.  The new
+    // default submit element is responsible for its own state update.
+    if (oldDefaultSubmit && oldDefaultSubmit != mDefaultSubmitElement) {
+      oldDefaultSubmit->UpdateState(aNotify);
+    }
+  }
+
+  // If the element is subject to constraint validaton and is invalid, we need
+  // to update our internal counter.
+  if (aUpdateValidity) {
+    nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild);
+    if (cvElmt &&
+        cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) {
+      UpdateValidity(false);
+    }
+  }
+
+  // Notify the radio button it's been added to a group
+  // This has to be done _after_ UpdateValidity() call to prevent the element
+  // being count twice.
+  if (type == NS_FORM_INPUT_RADIO) {
+    RefPtr<HTMLInputElement> radio =
+      static_cast<HTMLInputElement*>(aChild);
+    radio->AddedToRadioGroup();
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::AddElementToTable(nsGenericHTMLFormElement* aChild,
+                                   const nsAString& aName)
+{
+  return mControls->AddElementToTable(aChild, aName);
+}
+
+
+nsresult
+HTMLFormElement::RemoveElement(nsGenericHTMLFormElement* aChild,
+                               bool aUpdateValidity)
+{
+  //
+  // Remove it from the radio group if it's a radio button
+  //
+  nsresult rv = NS_OK;
+  if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
+    RefPtr<HTMLInputElement> radio =
+      static_cast<HTMLInputElement*>(aChild);
+    radio->WillRemoveFromRadioGroup();
+  }
+
+  // Determine whether to remove the child from the elements list
+  // or the not in elements list.
+  bool childInElements = HTMLFormControlsCollection::ShouldBeInElements(aChild);
+  nsTArray<nsGenericHTMLFormElement*>& controls = childInElements ?
+      mControls->mElements :  mControls->mNotInElements;
+
+  // Find the index of the child. This will be used later if necessary
+  // to find the default submit.
+  size_t index = controls.IndexOf(aChild);
+  NS_ENSURE_STATE(index != controls.NoIndex);
+
+  controls.RemoveElementAt(index);
+
+  // Update our mFirstSubmit* values.
+  nsGenericHTMLFormElement** firstSubmitSlot =
+    childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
+  if (aChild == *firstSubmitSlot) {
+    *firstSubmitSlot = nullptr;
+
+    // We are removing the first submit in this list, find the new first submit
+    uint32_t length = controls.Length();
+    for (uint32_t i = index; i < length; ++i) {
+      nsGenericHTMLFormElement* currentControl = controls[i];
+      if (currentControl->IsSubmitControl()) {
+        *firstSubmitSlot = currentControl;
+        break;
+      }
+    }
+  }
+
+  if (aChild == mDefaultSubmitElement) {
+    // Need to reset mDefaultSubmitElement.  Do this asynchronously so
+    // that we're not doing it while the DOM is in flux.
+    mDefaultSubmitElement = nullptr;
+    nsContentUtils::AddScriptRunner(new RemoveElementRunnable(this));
+
+    // Note that we don't need to notify on the old default submit (which is
+    // being removed) because it's either being removed from the DOM or
+    // changing attributes in a way that makes it responsible for sending its
+    // own notifications.
+  }
+
+  // If the element was subject to constraint validaton and is invalid, we need
+  // to update our internal counter.
+  if (aUpdateValidity) {
+    nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aChild);
+    if (cvElmt &&
+        cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) {
+      UpdateValidity(true);
+    }
+  }
+
+  return rv;
+}
+
+void
+HTMLFormElement::HandleDefaultSubmitRemoval()
+{
+  if (mDefaultSubmitElement) {
+    // Already got reset somehow; nothing else to do here
+    return;
+  }
+
+  if (!mFirstSubmitNotInElements) {
+    mDefaultSubmitElement = mFirstSubmitInElements;
+  } else if (!mFirstSubmitInElements) {
+    mDefaultSubmitElement = mFirstSubmitNotInElements;
+  } else {
+    NS_ASSERTION(mFirstSubmitInElements != mFirstSubmitNotInElements,
+                 "How did that happen?");
+    // Have both; use the earlier one
+    mDefaultSubmitElement =
+      CompareFormControlPosition(mFirstSubmitInElements,
+                                 mFirstSubmitNotInElements, this) < 0 ?
+      mFirstSubmitInElements : mFirstSubmitNotInElements;
+  }
+
+  NS_POSTCONDITION(mDefaultSubmitElement == mFirstSubmitInElements ||
+                   mDefaultSubmitElement == mFirstSubmitNotInElements,
+                   "What happened here?");
+
+  // Notify about change if needed.
+  if (mDefaultSubmitElement) {
+    mDefaultSubmitElement->UpdateState(true);
+  }
+}
+
+nsresult
+HTMLFormElement::RemoveElementFromTableInternal(
+  nsInterfaceHashtable<nsStringHashKey,nsISupports>& aTable,
+  nsIContent* aChild, const nsAString& aName)
+{
+  nsCOMPtr<nsISupports> supports;
+
+  if (!aTable.Get(aName, getter_AddRefs(supports)))
+    return NS_OK;
+
+  // Single element in the hash, just remove it if it's the one
+  // we're trying to remove...
+  if (supports == aChild) {
+    aTable.Remove(aName);
+    ++mExpandoAndGeneration.generation;
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
+  if (content) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
+  NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
+
+  // Upcast, uggly, but it works!
+  nsBaseContentList *list = static_cast<nsBaseContentList*>(nodeList.get());
+
+  list->RemoveElement(aChild);
+
+  uint32_t length = 0;
+  list->GetLength(&length);
+
+  if (!length) {
+    // If the list is empty we remove if from our hash, this shouldn't
+    // happen tho
+    aTable.Remove(aName);
+    ++mExpandoAndGeneration.generation;
+  } else if (length == 1) {
+    // Only one element left, replace the list in the hash with the
+    // single element.
+    nsIContent* node = list->Item(0);
+    if (node) {
+      aTable.Put(aName, node);
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::RemoveElementFromTable(nsGenericHTMLFormElement* aElement,
+                                        const nsAString& aName,
+                                        RemoveElementReason aRemoveReason)
+{
+  // If the element is being removed from the form, we have to remove it from
+  // the past names map.
+  if (aRemoveReason == ElementRemoved) {
+    uint32_t oldCount = mPastNameLookupTable.Count();
+    for (auto iter = mPastNameLookupTable.Iter(); !iter.Done(); iter.Next()) {
+      if (static_cast<void*>(aElement) == iter.Data()) {
+        iter.Remove();
+      }
+    }
+    if (oldCount != mPastNameLookupTable.Count()) {
+      ++mExpandoAndGeneration.generation;
+    }
+  }
+
+  return mControls->RemoveElementFromTable(aElement, aName);
+}
+
+already_AddRefed<nsISupports>
+HTMLFormElement::NamedGetter(const nsAString& aName, bool &aFound)
+{
+  aFound = true;
+
+  nsCOMPtr<nsISupports> result = DoResolveName(aName, true);
+  if (result) {
+    AddToPastNamesMap(aName, result);
+    return result.forget();
+  }
+
+  result = mImageNameLookupTable.GetWeak(aName);
+  if (result) {
+    AddToPastNamesMap(aName, result);
+    return result.forget();
+  }
+
+  result = mPastNameLookupTable.GetWeak(aName);
+  if (result) {
+    return result.forget();
+  }
+
+  aFound = false;
+  return nullptr;
+}
+
+void
+HTMLFormElement::GetSupportedNames(nsTArray<nsString >& aRetval)
+{
+  // TODO https://github.com/whatwg/html/issues/1731
+}
+
+already_AddRefed<nsISupports>
+HTMLFormElement::FindNamedItem(const nsAString& aName,
+                               nsWrapperCache** aCache)
+{
+  // FIXME Get the wrapper cache from DoResolveName.
+
+  bool found;
+  nsCOMPtr<nsISupports> result = NamedGetter(aName, found);
+  if (result) {
+    *aCache = nullptr;
+    return result.forget();
+  }
+
+  return nullptr;
+}
+
+already_AddRefed<nsISupports>
+HTMLFormElement::DoResolveName(const nsAString& aName,
+                               bool aFlushContent)
+{
+  nsCOMPtr<nsISupports> result =
+    mControls->NamedItemInternal(aName, aFlushContent);
+  return result.forget();
+}
+
+void
+HTMLFormElement::OnSubmitClickBegin(nsIContent* aOriginatingElement)
+{
+  mDeferSubmission = true;
+
+  // Prepare to run NotifySubmitObservers early before the
+  // scripts on the page get to modify the form data, possibly
+  // throwing off any password manager. (bug 257781)
+  nsCOMPtr<nsIURI> actionURI;
+  nsresult rv;
+
+  rv = GetActionURL(getter_AddRefs(actionURI), aOriginatingElement);
+  if (NS_FAILED(rv) || !actionURI)
+    return;
+
+  // Notify observers of submit if the form is valid.
+  // TODO: checking for mInvalidElementsCount is a temporary fix that should be
+  // removed with bug 610402.
+  if (mInvalidElementsCount == 0) {
+    bool cancelSubmit = false;
+    rv = NotifySubmitObservers(actionURI, &cancelSubmit, true);
+    if (NS_SUCCEEDED(rv)) {
+      mNotifiedObservers = true;
+      mNotifiedObserversResult = cancelSubmit;
+    }
+  }
+}
+
+void
+HTMLFormElement::OnSubmitClickEnd()
+{
+  mDeferSubmission = false;
+}
+
+void
+HTMLFormElement::FlushPendingSubmission()
+{
+  if (mPendingSubmission) {
+    // Transfer owning reference so that the submissioin doesn't get deleted
+    // if we reenter
+    nsAutoPtr<HTMLFormSubmission> submission = Move(mPendingSubmission);
+
+    SubmitSubmission(submission);
+  }
+}
+
+nsresult
+HTMLFormElement::GetActionURL(nsIURI** aActionURL,
+                              nsIContent* aOriginatingElement)
+{
+  nsresult rv = NS_OK;
+
+  *aActionURL = nullptr;
+
+  //
+  // Grab the URL string
+  //
+  // If the originating element is a submit control and has the formaction
+  // attribute specified, it should be used. Otherwise, the action attribute
+  // from the form element should be used.
+  //
+  nsAutoString action;
+
+  if (aOriginatingElement &&
+      aOriginatingElement->HasAttr(kNameSpaceID_None, nsGkAtoms::formaction)) {
+#ifdef DEBUG
+    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(aOriginatingElement);
+    NS_ASSERTION(formControl && formControl->IsSubmitControl(),
+                 "The originating element must be a submit form control!");
+#endif // DEBUG
+
+    nsCOMPtr<nsIDOMHTMLInputElement> inputElement = do_QueryInterface(aOriginatingElement);
+    if (inputElement) {
+      inputElement->GetFormAction(action);
+    } else {
+      nsCOMPtr<nsIDOMHTMLButtonElement> buttonElement = do_QueryInterface(aOriginatingElement);
+      if (buttonElement) {
+        buttonElement->GetFormAction(action);
+      } else {
+        NS_ERROR("Originating element must be an input or button element!");
+        return NS_ERROR_UNEXPECTED;
+      }
+    }
+  } else {
+    GetAction(action);
+  }
+
+  //
+  // Form the full action URL
+  //
+
+  // Get the document to form the URL.
+  // We'll also need it later to get the DOM window when notifying form submit
+  // observers (bug 33203)
+  if (!IsInUncomposedDoc()) {
+    return NS_OK; // No doc means don't submit, see Bug 28988
+  }
+
+  // Get base URL
+  nsIDocument *document = OwnerDoc();
+  nsIURI *docURI = document->GetDocumentURI();
+  NS_ENSURE_TRUE(docURI, NS_ERROR_UNEXPECTED);
+
+  // If an action is not specified and we are inside
+  // a HTML document then reload the URL. This makes us
+  // compatible with 4.x browsers.
+  // If we are in some other type of document such as XML or
+  // XUL, do nothing. This prevents undesirable reloading of
+  // a document inside XUL.
+
+  nsCOMPtr<nsIURI> actionURL;
+  if (action.IsEmpty()) {
+    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document));
+    if (!htmlDoc) {
+      // Must be a XML, XUL or other non-HTML document type
+      // so do nothing.
+      return NS_OK;
+    }
+
+    rv = docURI->Clone(getter_AddRefs(actionURL));
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else {
+    nsCOMPtr<nsIURI> baseURL = GetBaseURI();
+    NS_ASSERTION(baseURL, "No Base URL found in Form Submit!\n");
+    if (!baseURL) {
+      return NS_OK; // No base URL -> exit early, see Bug 30721
+    }
+    rv = NS_NewURI(getter_AddRefs(actionURL), action, nullptr, baseURL);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  //
+  // Verify the URL should be reached
+  //
+  // Get security manager, check to see if access to action URI is allowed.
+  //
+  nsIScriptSecurityManager *securityManager =
+      nsContentUtils::GetSecurityManager();
+  rv = securityManager->
+    CheckLoadURIWithPrincipal(NodePrincipal(), actionURL,
+                              nsIScriptSecurityManager::STANDARD);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Check if CSP allows this form-action
+  nsCOMPtr<nsIContentSecurityPolicy> csp;
+  rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (csp) {
+    bool permitsFormAction = true;
+
+    // form-action is only enforced if explicitly defined in the
+    // policy - do *not* consult default-src, see:
+    // http://www.w3.org/TR/CSP2/#directive-default-src
+    rv = csp->Permits(actionURL, nsIContentSecurityPolicy::FORM_ACTION_DIRECTIVE,
+                      true, &permitsFormAction);
+    NS_ENSURE_SUCCESS(rv, rv);
+    if (!permitsFormAction) {
+      return NS_ERROR_CSP_FORM_ACTION_VIOLATION;
+    }
+  }
+
+  // Potentially the page uses the CSP directive 'upgrade-insecure-requests'. In
+  // such a case we have to upgrade the action url from http:// to https://.
+  // If the actionURL is not http, then there is nothing to do.
+  bool isHttpScheme = false;
+  rv = actionURL->SchemeIs("http", &isHttpScheme);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (isHttpScheme && document->GetUpgradeInsecureRequests(false)) {
+    // let's use the old specification before the upgrade for logging
+    nsAutoCString spec;
+    rv = actionURL->GetSpec(spec);
+    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ConvertUTF8toUTF16 reportSpec(spec);
+
+    // upgrade the actionURL from http:// to use https://
+    nsCOMPtr<nsIURI> upgradedActionURL;
+    rv = NS_GetSecureUpgradedURI(actionURL, getter_AddRefs(upgradedActionURL));
+    NS_ENSURE_SUCCESS(rv, rv);
+    actionURL = upgradedActionURL.forget();
+
+    // let's log a message to the console that we are upgrading a request
+    nsAutoCString scheme;
+    rv = actionURL->GetScheme(scheme);
+    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ConvertUTF8toUTF16 reportScheme(scheme);
+
+    const char16_t* params[] = { reportSpec.get(), reportScheme.get() };
+    CSP_LogLocalizedStr(u"upgradeInsecureRequest",
+                        params, ArrayLength(params),
+                        EmptyString(), // aSourceFile
+                        EmptyString(), // aScriptSample
+                        0, // aLineNumber
+                        0, // aColumnNumber
+                        nsIScriptError::warningFlag, "CSP",
+                        document->InnerWindowID());
+  }
+
+  //
+  // Assign to the output
+  //
+  actionURL.forget(aActionURL);
+
+  return rv;
+}
+
+NS_IMETHODIMP_(nsIFormControl*)
+HTMLFormElement::GetDefaultSubmitElement() const
+{
+  NS_PRECONDITION(mDefaultSubmitElement == mFirstSubmitInElements ||
+                  mDefaultSubmitElement == mFirstSubmitNotInElements,
+                  "What happened here?");
+
+  return mDefaultSubmitElement;
+}
+
+bool
+HTMLFormElement::IsDefaultSubmitElement(const nsIFormControl* aControl) const
+{
+  NS_PRECONDITION(aControl, "Unexpected call");
+
+  if (aControl == mDefaultSubmitElement) {
+    // Yes, it is
+    return true;
+  }
+
+  if (mDefaultSubmitElement ||
+      (aControl != mFirstSubmitInElements &&
+       aControl != mFirstSubmitNotInElements)) {
+    // It isn't
+    return false;
+  }
+
+  // mDefaultSubmitElement is null, but we have a non-null submit around
+  // (aControl, in fact).  figure out whether it's in fact the default submit
+  // and just hasn't been set that way yet.  Note that we can't just call
+  // HandleDefaultSubmitRemoval because we might need to notify to handle that
+  // correctly and we don't know whether that's safe right here.
+  if (!mFirstSubmitInElements || !mFirstSubmitNotInElements) {
+    // We only have one first submit; aControl has to be it
+    return true;
+  }
+
+  // We have both kinds of submits.  Check which comes first.
+  nsIFormControl* defaultSubmit =
+    CompareFormControlPosition(mFirstSubmitInElements,
+                               mFirstSubmitNotInElements, this) < 0 ?
+      mFirstSubmitInElements : mFirstSubmitNotInElements;
+  return aControl == defaultSubmit;
+}
+
+bool
+HTMLFormElement::ImplicitSubmissionIsDisabled() const
+{
+  // Input text controls are always in the elements list.
+  uint32_t numDisablingControlsFound = 0;
+  uint32_t length = mControls->mElements.Length();
+  for (uint32_t i = 0; i < length && numDisablingControlsFound < 2; ++i) {
+    if (mControls->mElements[i]->IsSingleLineTextControl(false) ||
+        mControls->mElements[i]->GetType() == NS_FORM_INPUT_NUMBER) {
+      numDisablingControlsFound++;
+    }
+  }
+  return numDisablingControlsFound != 1;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::GetEncoding(nsAString& aEncoding)
+{
+  return GetEnctype(aEncoding);
+}
+
+NS_IMETHODIMP
+HTMLFormElement::SetEncoding(const nsAString& aEncoding)
+{
+  return SetEnctype(aEncoding);
+}
+
+int32_t
+HTMLFormElement::Length()
+{
+  return mControls->Length();
+}
+
+NS_IMETHODIMP
+HTMLFormElement::GetLength(int32_t* aLength)
+{
+  *aLength = Length();
+  return NS_OK;
+}
+
+void
+HTMLFormElement::ForgetCurrentSubmission()
+{
+  mNotifiedObservers = false;
+  mIsSubmitting = false;
+  mSubmittingRequest = nullptr;
+  nsCOMPtr<nsIWebProgress> webProgress = do_QueryReferent(mWebProgress);
+  if (webProgress) {
+    webProgress->RemoveProgressListener(this);
+  }
+  mWebProgress = nullptr;
+}
+
+bool
+HTMLFormElement::CheckFormValidity(nsIMutableArray* aInvalidElements) const
+{
+  bool ret = true;
+
+  nsTArray<nsGenericHTMLFormElement*> sortedControls;
+  if (NS_FAILED(mControls->GetSortedControls(sortedControls))) {
+    return false;
+  }
+
+  uint32_t len = sortedControls.Length();
+
+  // Hold a reference to the elements so they can't be deleted while calling
+  // the invalid events.
+  for (uint32_t i = 0; i < len; ++i) {
+    sortedControls[i]->AddRef();
+  }
+
+  for (uint32_t i = 0; i < len; ++i) {
+    nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(sortedControls[i]);
+    if (cvElmt && cvElmt->IsCandidateForConstraintValidation() &&
+        !cvElmt->IsValid()) {
+      ret = false;
+      bool defaultAction = true;
+      nsContentUtils::DispatchTrustedEvent(sortedControls[i]->OwnerDoc(),
+                                           static_cast<nsIContent*>(sortedControls[i]),
+                                           NS_LITERAL_STRING("invalid"),
+                                           false, true, &defaultAction);
+
+      // Add all unhandled invalid controls to aInvalidElements if the caller
+      // requested them.
+      if (defaultAction && aInvalidElements) {
+        aInvalidElements->AppendElement(ToSupports(sortedControls[i]),
+                                        false);
+      }
+    }
+  }
+
+  // Release the references.
+  for (uint32_t i = 0; i < len; ++i) {
+    static_cast<nsGenericHTMLElement*>(sortedControls[i])->Release();
+  }
+
+  return ret;
+}
+
+bool
+HTMLFormElement::CheckValidFormSubmission()
+{
+  /**
+   * Check for form validity: do not submit a form if there are unhandled
+   * invalid controls in the form.
+   * This should not be done if the form has been submitted with .submit().
+   *
+   * NOTE: for the moment, we are also checking that there is an observer for
+   * NS_INVALIDFORMSUBMIT_SUBJECT so it will prevent blocking form submission
+   * if the browser does not have implemented a UI yet.
+   *
+   * TODO: the check for observer should be removed later when HTML5 Forms will
+   * be spread enough and authors will assume forms can't be submitted when
+   * invalid. See bug 587671.
+   */
+
+  NS_ASSERTION(!HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate),
+               "We shouldn't be there if novalidate is set!");
+
+  // When .submit() is called aEvent = nullptr so we can rely on that to know if
+  // we have to check the validity of the form.
+  nsCOMPtr<nsIObserverService> service =
+    mozilla::services::GetObserverService();
+  if (!service) {
+    NS_WARNING("No observer service available!");
+    return true;
+  }
+
+  nsCOMPtr<nsISimpleEnumerator> theEnum;
+  nsresult rv = service->EnumerateObservers(NS_INVALIDFORMSUBMIT_SUBJECT,
+                                            getter_AddRefs(theEnum));
+  // Return true on error here because that's what we always did
+  NS_ENSURE_SUCCESS(rv, true);
+
+  bool hasObserver = false;
+  rv = theEnum->HasMoreElements(&hasObserver);
+
+  // Do not check form validity if there is no observer for
+  // NS_INVALIDFORMSUBMIT_SUBJECT.
+  if (NS_SUCCEEDED(rv) && hasObserver) {
+    nsCOMPtr<nsIMutableArray> invalidElements =
+      do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
+    // Return true on error here because that's what we always did
+    NS_ENSURE_SUCCESS(rv, true);
+
+    if (!CheckFormValidity(invalidElements.get())) {
+      // For the first invalid submission, we should update element states.
+      // We have to do that _before_ calling the observers so we are sure they
+      // will not interfere (like focusing the element).
+      if (!mEverTriedInvalidSubmit) {
+        mEverTriedInvalidSubmit = true;
+
+        /*
+         * We are going to call update states assuming elements want to
+         * be notified because we can't know.
+         * Submissions shouldn't happen during parsing so it _should_ be safe.
+         */
+
+        nsAutoScriptBlocker scriptBlocker;
+
+        for (uint32_t i = 0, length = mControls->mElements.Length();
+             i < length; ++i) {
+          // Input elements can trigger a form submission and we want to
+          // update the style in that case.
+          if (mControls->mElements[i]->IsHTMLElement(nsGkAtoms::input) &&
+              nsContentUtils::IsFocusedContent(mControls->mElements[i])) {
+            static_cast<HTMLInputElement*>(mControls->mElements[i])
+              ->UpdateValidityUIBits(true);
+          }
+
+          mControls->mElements[i]->UpdateState(true);
+        }
+
+        // Because of backward compatibility, <input type='image'> is not in
+        // elements but can be invalid.
+        // TODO: should probably be removed when bug 606491 will be fixed.
+        for (uint32_t i = 0, length = mControls->mNotInElements.Length();
+             i < length; ++i) {
+          mControls->mNotInElements[i]->UpdateState(true);
+        }
+      }
+
+      nsCOMPtr<nsISupports> inst;
+      nsCOMPtr<nsIFormSubmitObserver> observer;
+      bool more = true;
+      while (NS_SUCCEEDED(theEnum->HasMoreElements(&more)) && more) {
+        theEnum->GetNext(getter_AddRefs(inst));
+        observer = do_QueryInterface(inst);
+
+        if (observer) {
+          observer->NotifyInvalidSubmit(this,
+                                        static_cast<nsIArray*>(invalidElements));
+        }
+      }
+
+      // The form is invalid. Observers have been alerted. Do not submit.
+      return false;
+    }
+  } else {
+    NS_WARNING("There is no observer for \"invalidformsubmit\". \
+One should be implemented!");
+  }
+
+  return true;
+}
+
+bool
+HTMLFormElement::SubmissionCanProceed(Element* aSubmitter)
+{
+#ifdef DEBUG
+  if (aSubmitter) {
+    nsCOMPtr<nsIFormControl> fc = do_QueryInterface(aSubmitter);
+    MOZ_ASSERT(fc);
+
+    uint32_t type = fc->GetType();
+    MOZ_ASSERT(type == NS_FORM_INPUT_SUBMIT ||
+               type == NS_FORM_INPUT_IMAGE ||
+               type == NS_FORM_BUTTON_SUBMIT,
+               "aSubmitter is not a submit control?");
+  }
+#endif
+
+  // Modified step 2 of
+  // https://html.spec.whatwg.org/multipage/forms.html#concept-form-submit --
+  // we're not checking whether the node document is disconnected yet...
+  if (OwnerDoc()->GetSandboxFlags() & SANDBOXED_FORMS) {
+    return false;
+  }
+
+  if (HasAttr(kNameSpaceID_None, nsGkAtoms::novalidate)) {
+    return true;
+  }
+
+  if (aSubmitter &&
+      aSubmitter->HasAttr(kNameSpaceID_None, nsGkAtoms::formnovalidate)) {
+    return true;
+  }
+
+  return CheckValidFormSubmission();
+}
+
+void
+HTMLFormElement::UpdateValidity(bool aElementValidity)
+{
+  if (aElementValidity) {
+    --mInvalidElementsCount;
+  } else {
+    ++mInvalidElementsCount;
+  }
+
+  NS_ASSERTION(mInvalidElementsCount >= 0, "Something went seriously wrong!");
+
+  // The form validity has just changed if:
+  // - there are no more invalid elements ;
+  // - or there is one invalid elmement and an element just became invalid.
+  // If we have invalid elements and we used to before as well, do nothing.
+  if (mInvalidElementsCount &&
+      (mInvalidElementsCount != 1 || aElementValidity)) {
+    return;
+  }
+
+  /*
+   * We are going to update states assuming submit controls want to
+   * be notified because we can't know.
+   * UpdateValidity shouldn't be called so much during parsing so it _should_
+   * be safe.
+   */
+
+  nsAutoScriptBlocker scriptBlocker;
+
+  // Inform submit controls that the form validity has changed.
+  for (uint32_t i = 0, length = mControls->mElements.Length();
+       i < length; ++i) {
+    if (mControls->mElements[i]->IsSubmitControl()) {
+      mControls->mElements[i]->UpdateState(true);
+    }
+  }
+
+  // Because of backward compatibility, <input type='image'> is not in elements
+  // so we have to check for controls not in elements too.
+  uint32_t length = mControls->mNotInElements.Length();
+  for (uint32_t i = 0; i < length; ++i) {
+    if (mControls->mNotInElements[i]->IsSubmitControl()) {
+      mControls->mNotInElements[i]->UpdateState(true);
+    }
+  }
+
+  UpdateState(true);
+}
+
+// nsIWebProgressListener
+NS_IMETHODIMP
+HTMLFormElement::OnStateChange(nsIWebProgress* aWebProgress,
+                               nsIRequest* aRequest,
+                               uint32_t aStateFlags,
+                               nsresult aStatus)
+{
+  // If STATE_STOP is never fired for any reason (redirect?  Failed state
+  // change?) the form element will leak.  It will be kept around by the
+  // nsIWebProgressListener (assuming it keeps a strong pointer).  We will
+  // consequently leak the request.
+  if (aRequest == mSubmittingRequest &&
+      aStateFlags & nsIWebProgressListener::STATE_STOP) {
+    ForgetCurrentSubmission();
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::OnProgressChange(nsIWebProgress* aWebProgress,
+                                  nsIRequest* aRequest,
+                                  int32_t aCurSelfProgress,
+                                  int32_t aMaxSelfProgress,
+                                  int32_t aCurTotalProgress,
+                                  int32_t aMaxTotalProgress)
+{
+  NS_NOTREACHED("notification excluded in AddProgressListener(...)");
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::OnLocationChange(nsIWebProgress* aWebProgress,
+                                  nsIRequest* aRequest,
+                                  nsIURI* location,
+                                  uint32_t aFlags)
+{
+  NS_NOTREACHED("notification excluded in AddProgressListener(...)");
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::OnStatusChange(nsIWebProgress* aWebProgress,
+                                nsIRequest* aRequest,
+                                nsresult aStatus,
+                                const char16_t* aMessage)
+{
+  NS_NOTREACHED("notification excluded in AddProgressListener(...)");
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::OnSecurityChange(nsIWebProgress* aWebProgress,
+                                  nsIRequest* aRequest,
+                                  uint32_t state)
+{
+  NS_NOTREACHED("notification excluded in AddProgressListener(...)");
+  return NS_OK;
+}
+
+NS_IMETHODIMP_(int32_t)
+HTMLFormElement::IndexOfControl(nsIFormControl* aControl)
+{
+  int32_t index = 0;
+  return mControls->IndexOfControl(aControl, &index) == NS_OK ? index : 0;
+}
+
+void
+HTMLFormElement::SetCurrentRadioButton(const nsAString& aName,
+                                       HTMLInputElement* aRadio)
+{
+  mSelectedRadioButtons.Put(aName, aRadio);
+}
+
+HTMLInputElement*
+HTMLFormElement::GetCurrentRadioButton(const nsAString& aName)
+{
+  return mSelectedRadioButtons.GetWeak(aName);
+}
+
+NS_IMETHODIMP
+HTMLFormElement::GetNextRadioButton(const nsAString& aName,
+                                    const bool aPrevious,
+                                    HTMLInputElement* aFocusedRadio,
+                                    HTMLInputElement** aRadioOut)
+{
+  // Return the radio button relative to the focused radio button.
+  // If no radio is focused, get the radio relative to the selected one.
+  *aRadioOut = nullptr;
+
+  RefPtr<HTMLInputElement> currentRadio;
+  if (aFocusedRadio) {
+    currentRadio = aFocusedRadio;
+  }
+  else {
+    mSelectedRadioButtons.Get(aName, getter_AddRefs(currentRadio));
+  }
+
+  nsCOMPtr<nsISupports> itemWithName = DoResolveName(aName, true);
+  nsCOMPtr<nsINodeList> radioGroup(do_QueryInterface(itemWithName));
+
+  if (!radioGroup) {
+    return NS_ERROR_FAILURE;
+  }
+
+  int32_t index = radioGroup->IndexOf(currentRadio);
+  if (index < 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  uint32_t numRadios;
+  radioGroup->GetLength(&numRadios);
+  RefPtr<HTMLInputElement> radio;
+
+  bool isRadio = false;
+  do {
+    if (aPrevious) {
+      if (--index < 0) {
+        index = numRadios -1;
+      }
+    }
+    else if (++index >= (int32_t)numRadios) {
+      index = 0;
+    }
+    radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index));
+    isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO;
+    if (!isRadio) {
+      continue;
+    }
+
+    nsAutoString name;
+    radio->GetName(name);
+    isRadio = aName.Equals(name);
+  } while (!isRadio || (radio->Disabled() && radio != currentRadio));
+
+  NS_IF_ADDREF(*aRadioOut = radio);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+HTMLFormElement::WalkRadioGroup(const nsAString& aName,
+                                nsIRadioVisitor* aVisitor,
+                                bool aFlushContent)
+{
+  if (aName.IsEmpty()) {
+    //
+    // XXX If the name is empty, it's not stored in the control list.  There
+    // *must* be a more efficient way to do this.
+    //
+    nsCOMPtr<nsIFormControl> control;
+    uint32_t len = GetElementCount();
+    for (uint32_t i = 0; i < len; i++) {
+      control = GetElementAt(i);
+      if (control->GetType() == NS_FORM_INPUT_RADIO) {
+        nsCOMPtr<nsIContent> controlContent = do_QueryInterface(control);
+        if (controlContent &&
+            controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
+                                        EmptyString(), eCaseMatters) &&
+            !aVisitor->Visit(control)) {
+          break;
+        }
+      }
+    }
+    return NS_OK;
+  }
+
+  // Get the control / list of controls from the form using form["name"]
+  nsCOMPtr<nsISupports> item = DoResolveName(aName, aFlushContent);
+  if (!item) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // If it's just a lone radio button, then select it.
+  nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(item);
+  if (formControl) {
+    if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
+      aVisitor->Visit(formControl);
+    }
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(item);
+  if (!nodeList) {
+    return NS_OK;
+  }
+  uint32_t length = 0;
+  nodeList->GetLength(&length);
+  for (uint32_t i = 0; i < length; i++) {
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->Item(i, getter_AddRefs(node));
+    nsCOMPtr<nsIFormControl> formControl = do_QueryInterface(node);
+    if (formControl && formControl->GetType() == NS_FORM_INPUT_RADIO &&
+        !aVisitor->Visit(formControl)) {
+      break;
+    }
+  }
+  return NS_OK;
+}
+
+void
+HTMLFormElement::AddToRadioGroup(const nsAString& aName,
+                                 nsIFormControl* aRadio)
+{
+  nsCOMPtr<nsIContent> element = do_QueryInterface(aRadio);
+  NS_ASSERTION(element, "radio controls have to be content elements!");
+
+  if (element->HasAttr(kNameSpaceID_None, nsGkAtoms::required)) {
+    mRequiredRadioButtonCounts.Put(aName,
+                                   mRequiredRadioButtonCounts.Get(aName)+1);
+  }
+}
+
+void
+HTMLFormElement::RemoveFromRadioGroup(const nsAString& aName,
+                                      nsIFormControl* aRadio)
+{
+  nsCOMPtr<nsIContent> element = do_QueryInterface(aRadio);
+  NS_ASSERTION(element, "radio controls have to be content elements!");
+
+  if (element->HasAttr(kNameSpaceID_None, nsGkAtoms::required)) {
+    uint32_t requiredNb = mRequiredRadioButtonCounts.Get(aName);
+    NS_ASSERTION(requiredNb >= 1,
+                 "At least one radio button has to be required!");
+
+    if (requiredNb == 1) {
+      mRequiredRadioButtonCounts.Remove(aName);
+    } else {
+      mRequiredRadioButtonCounts.Put(aName, requiredNb-1);
+    }
+  }
+}
+
+uint32_t
+HTMLFormElement::GetRequiredRadioCount(const nsAString& aName) const
+{
+  return mRequiredRadioButtonCounts.Get(aName);
+}
+
+void
+HTMLFormElement::RadioRequiredWillChange(const nsAString& aName,
+                                         bool aRequiredAdded)
+{
+  if (aRequiredAdded) {
+    mRequiredRadioButtonCounts.Put(aName,
+                                   mRequiredRadioButtonCounts.Get(aName)+1);
+  } else {
+    uint32_t requiredNb = mRequiredRadioButtonCounts.Get(aName);
+    NS_ASSERTION(requiredNb >= 1,
+                 "At least one radio button has to be required!");
+    if (requiredNb == 1) {
+      mRequiredRadioButtonCounts.Remove(aName);
+    } else {
+      mRequiredRadioButtonCounts.Put(aName, requiredNb-1);
+    }
+  }
+}
+
+bool
+HTMLFormElement::GetValueMissingState(const nsAString& aName) const
+{
+  return mValueMissingRadioGroups.Get(aName);
+}
+
+void
+HTMLFormElement::SetValueMissingState(const nsAString& aName, bool aValue)
+{
+  mValueMissingRadioGroups.Put(aName, aValue);
+}
+
+EventStates
+HTMLFormElement::IntrinsicState() const
+{
+  EventStates state = nsGenericHTMLElement::IntrinsicState();
+
+  if (mInvalidElementsCount) {
+    state |= NS_EVENT_STATE_INVALID;
+  } else {
+      state |= NS_EVENT_STATE_VALID;
+  }
+
+  return state;
+}
+
+void
+HTMLFormElement::Clear()
+{
+  for (int32_t i = mImageElements.Length() - 1; i >= 0; i--) {
+    mImageElements[i]->ClearForm(false);
+  }
+  mImageElements.Clear();
+  mImageNameLookupTable.Clear();
+  mPastNameLookupTable.Clear();
+}
+
+namespace {
+
+struct PositionComparator
+{
+  nsIContent* const mElement;
+  explicit PositionComparator(nsIContent* const aElement) : mElement(aElement) {}
+
+  int operator()(nsIContent* aElement) const {
+    if (mElement == aElement) {
+      return 0;
+    }
+    if (nsContentUtils::PositionIsBefore(mElement, aElement)) {
+      return -1;
+    }
+    return 1;
+  }
+};
+
+struct NodeListAdaptor
+{
+  nsINodeList* const mList;
+  explicit NodeListAdaptor(nsINodeList* aList) : mList(aList) {}
+  nsIContent* operator[](size_t aIdx) const {
+    return mList->Item(aIdx);
+  }
+};
+
+} // namespace
+
+nsresult
+HTMLFormElement::AddElementToTableInternal(
+  nsInterfaceHashtable<nsStringHashKey,nsISupports>& aTable,
+  nsIContent* aChild, const nsAString& aName)
+{
+  nsCOMPtr<nsISupports> supports;
+  aTable.Get(aName, getter_AddRefs(supports));
+
+  if (!supports) {
+    // No entry found, add the element
+    aTable.Put(aName, aChild);
+    ++mExpandoAndGeneration.generation;
+  } else {
+    // Found something in the hash, check its type
+    nsCOMPtr<nsIContent> content = do_QueryInterface(supports);
+
+    if (content) {
+      // Check if the new content is the same as the one we found in the
+      // hash, if it is then we leave it in the hash as it is, this will
+      // happen if a form control has both a name and an id with the same
+      // value
+      if (content == aChild) {
+        return NS_OK;
+      }
+
+      // Found an element, create a list, add the element to the list and put
+      // the list in the hash
+      RadioNodeList *list = new RadioNodeList(this);
+
+      // If an element has a @form, we can assume it *might* be able to not have
+      // a parent and still be in the form.
+      NS_ASSERTION(content->HasAttr(kNameSpaceID_None, nsGkAtoms::form) ||
+                   content->GetParent(), "Item in list without parent");
+
+      // Determine the ordering between the new and old element.
+      bool newFirst = nsContentUtils::PositionIsBefore(aChild, content);
+
+      list->AppendElement(newFirst ? aChild : content.get());
+      list->AppendElement(newFirst ? content.get() : aChild);
+
+
+      nsCOMPtr<nsISupports> listSupports = do_QueryObject(list);
+
+      // Replace the element with the list.
+      aTable.Put(aName, listSupports);
+    } else {
+      // There's already a list in the hash, add the child to the list
+      nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
+      NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
+
+      // Upcast, uggly, but it works!
+      RadioNodeList *list =
+        static_cast<RadioNodeList*>(nodeList.get());
+
+      NS_ASSERTION(list->Length() > 1,
+                   "List should have been converted back to a single element");
+
+      // Fast-path appends; this check is ok even if the child is
+      // already in the list, since if it tests true the child would
+      // have come at the end of the list, and the PositionIsBefore
+      // will test false.
+      if (nsContentUtils::PositionIsBefore(list->Item(list->Length() - 1), aChild)) {
+        list->AppendElement(aChild);
+        return NS_OK;
+      }
+
+      // If a control has a name equal to its id, it could be in the
+      // list already.
+      if (list->IndexOf(aChild) != -1) {
+        return NS_OK;
+      }
+
+      size_t idx;
+      DebugOnly<bool> found = BinarySearchIf(NodeListAdaptor(list), 0, list->Length(),
+                                             PositionComparator(aChild), &idx);
+      MOZ_ASSERT(!found, "should not have found an element");
+
+      list->InsertElementAt(aChild, idx);
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::AddImageElement(HTMLImageElement* aChild)
+{
+  AddElementToList(mImageElements, aChild, this);
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::AddImageElementToTable(HTMLImageElement* aChild,
+                                        const nsAString& aName)
+{
+  return AddElementToTableInternal(mImageNameLookupTable, aChild, aName);
+}
+
+nsresult
+HTMLFormElement::RemoveImageElement(HTMLImageElement* aChild)
+{
+  size_t index = mImageElements.IndexOf(aChild);
+  NS_ENSURE_STATE(index != mImageElements.NoIndex);
+
+  mImageElements.RemoveElementAt(index);
+  return NS_OK;
+}
+
+nsresult
+HTMLFormElement::RemoveImageElementFromTable(HTMLImageElement* aElement,
+                                             const nsAString& aName,
+                                             RemoveElementReason aRemoveReason)
+{
+  // If the element is being removed from the form, we have to remove it from
+  // the past names map.
+  if (aRemoveReason == ElementRemoved) {
+    for (auto iter = mPastNameLookupTable.Iter(); !iter.Done(); iter.Next()) {
+      if (static_cast<void*>(aElement) == iter.Data()) {
+        iter.Remove();
+      }
+    }
+  }
+
+  return RemoveElementFromTableInternal(mImageNameLookupTable, aElement, aName);
+}
+
+void
+HTMLFormElement::AddToPastNamesMap(const nsAString& aName,
+                                   nsISupports* aChild)
+{
+  // If candidates contains exactly one node. Add a mapping from name to the
+  // node in candidates in the form element's past names map, replacing the
+  // previous entry with the same name, if any.
+  nsCOMPtr<nsIContent> node = do_QueryInterface(aChild);
+  if (node) {
+    mPastNameLookupTable.Put(aName, aChild);
+  }
+}
+
+JSObject*
+HTMLFormElement::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
+{
+  return HTMLFormElementBinding::Wrap(aCx, this, aGivenProto);
+}
+
+} // namespace dom
+} // namespace mozilla