forms: honor formaction / formmethod / formenctype on submit button

[navidemad]

What

When a form is submitted via a click on a submit button (or form.requestSubmit(button)), the submitter's formaction / formmethod / formenctype attributes are silently ignored — the form's own attributes always win. Per the HTML form-submission algorithm these per-submitter attributes must override the form's, and the symmetrical lookup already exists for formtarget. This PR adds the same submitter-first lookup for the other three.

Closes #2278.

Root cause

Frame.submitForm in src/browser/Frame.zig reads action, method, and enctype only from the form element. The submitter parameter (already plumbed through for the disabled check, SubmitEvent.submitter, and FormData.init) is ignored in those three lookups. formtarget works because that lookup is correct (lines 3684-3691 on main).

flowchart LR
    A[click submit button] --> B[Frame.submitForm]
    B --> C[action = form.action]
    B --> D[method = form.method]
    B --> E[enctype = form.enctype]
    C --> F[wrong URL]
    D --> F
    E --> F
    style C fill:#fdd
    style D fill:#fdd
    style E fill:#fdd
    style F fill:#fdd

Loading

Fix

• src/browser/Frame.zig — submitForm: wrap the enctype / method / action lookups in submitter-first blocks, falling back to the form's attribute when the submitter has none. Mirrors the existing formtarget block.

flowchart LR
    A[click submit button] --> B[Frame.submitForm]
    B --> C[action = submitter.formaction OR form.action]
    B --> D[method = submitter.formmethod OR form.method]
    B --> E[enctype = submitter.formenctype OR form.enctype]
    C --> F[correct URL]
    D --> F
    E --> F
    style C fill:#dfd
    style D fill:#dfd
    style E fill:#dfd
    style F fill:#dfd

Loading

Test

• HTML test: src/browser/tests/frames/target.html adds three new fixtures next to the existing formtarget test:
  • formaction — form action support/should-not-load.html, button formaction="support/page.html" → iframe loads page.html
  • formmethod — form method GET action support/page.html, input name=x value=probe, button formmethod="POST" → iframe URL has no query string (POST sent the FormData in the body, not appended to the URL)
  • formaction_and_formmethod — both overrides on the same submitter
• Verified locally: TEST_FILTER='WebApi: Frames#target' mise exec -- zig build test $V8 passes with the fix, fails on main.
• Reproducer: a self-contained repro.sh (HTML fixture + Python static server + Node CDP driver via raw ws) is documented in forms: formaction / formmethod / formenctype on submit button are ignored #2278. Exits 1 on main (3 of 4 cases FAIL), exits 0 with this commit (all 4 PASS) when run against a local debug build of this branch.

Notes

• DOM-level IDL accessors formAction / formMethod / formEnctype are not exposed on HTMLButtonElement / HTMLInputElement upstream yet — the getAttribute('formaction') / etc. content-attribute path used here works regardless. Adding the IDL accessors is independent and out of scope for this PR.
• The submit-button check is intentionally not gated on isSubmitButton(submitter) — the existing formtarget lookup at lines 3684-3691 doesn't gate either, and a non-button submitter (e.g. an <input type=text> after Enter) won't have these attributes set on it in well-formed HTML, so the getAttributeSafe returns null and the form's attribute is used. Matches precedent.