[Webkit-unassigned] [Bug 111778] New: Empty file input is submitted incorrectly

Thu Mar 7 15:02:27 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=111778

           Summary: Empty file input is submitted incorrectly
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Forms
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ap at webkit.org
                CC: michaeln at google.com

When we are submitting an <input type=file> that does not have a file in it, we (correctly) send an empty file. But we do with two mistakes:

1) We create a File with an empty path, which is invalid. We should be using some other way to achieve this, such as perhaps an empty Blob.

2) The File is destroyed before the form is actually submitted, so BlobRegistry has to deal with an unregistered blob URL. The File is owned by DOMFormData, and that's destroyed at the end of FormSubmission::create(). So, a Blob or a File becomes unregistered in blob registry, and cannot be used when actually building form data stream in another process.

We should obviously keep uploaded objects alive while form submission takes place.