Allow one form to navigate multiple frames consecutively

This patch allows one form to navigate two different frames by moving
all state associated with the form submission which occurs after the
async step as described in [1] from the form element and the
form element's document to the target frame being navigated.
Despite the spec saying that the task should be stored in the form
element, firefox and safari are both able to navigate multiple frames
like this. I plan to follow this up with a spec issue.

This organization of state reflect what we used to have with
NavigationScheduler [2], which was a member of LocalFrame.

I decided to use Frame instead of LocalFrame so that we can have the
same semantics for form submission regardless of whether we are
submitting to a LocalFrame or a RemoteFrame. The effects are observable
in this wpt: [3]

This patch disables some double-submit tests. These double-submit tests
were added to cover http://crbug.com/977882, however, they do so by
targeting different frames. This is not the behavior sites which
reported the bug had, and the bug will not reproduce with this patch.
This patch basically gets us back to the behavior we had before the
patch which caused that bug.
Any site which relied on the exact behavior in the test would have only
been able to do so since http://crrev.com/c/1850358, which was landed 7
months ago. I plan to follow up and try to get the test passing again in
this bug: http://crbug.com/1087077

[1] http://html.spec.whatwg.org/C/#plan-to-navigate
[2] https://source.chromium.org/chromium/chromium/src/+/master:third_party/blink/renderer/core/html/forms/html_form_element.cc;l=519-520;drc=8f4e07de2e8797821a9446eb66ceeb305d763cbf
[3] https://source.chromium.org/chromium/chromium/src/+/master:third_party/blink/web_tests/external/wpt/html/semantics/forms/form-submission-0/form-double-submit-to-different-origin-frame.html

Bug: 1085097, 1047489
Change-Id: I1a212e52ef95449c5a0527d5530efaa49d384037
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2212458
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Reviewed-by: Mason Freed <masonfreed@chromium.org>
Reviewed-by: Nate Chapin <japhet@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#772785}
diff --git a/html/semantics/forms/form-submission-0/form-double-submit-multiple-targets.html b/html/semantics/forms/form-submission-0/form-double-submit-multiple-targets.html
new file mode 100644
index 0000000..2b5a589
--- /dev/null
+++ b/html/semantics/forms/form-submission-0/form-double-submit-multiple-targets.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" title="Joey Arhar" href="mailto:jarhar@chromium.org">
+
+<!-- The expected behavior of this test is not explicitly specified. -->
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<form id=myform name=myform action="/formaction.html"></form>
+<iframe id=frame1 name=target1></iframe>
+<iframe id=frame2 name=target2></iframe>
+<iframe id=frame3 name=target3></iframe>
+
+<script>
+
+promise_test(async () => {
+  const frame1LoadPromise = new Promise(resolve => frame1.onload = resolve);
+  const frame2LoadPromise = new Promise(resolve => frame2.onload = resolve);
+  const frame3LoadPromise = new Promise(resolve => frame3.onload = resolve);
+
+  myform.target = 'target1';
+  myform.submit();
+  myform.target = 'target2';
+  myform.submit();
+  myform.target = 'target3';
+  myform.submit();
+
+  await Promise.all([frame1LoadPromise, frame2LoadPromise, frame3LoadPromise]);
+
+  assert_equals(frame1.contentDocument.location.pathname, '/formaction.html');
+  assert_equals(frame2.contentDocument.location.pathname, '/formaction.html');
+  assert_equals(frame3.contentDocument.location.pathname, '/formaction.html');
+
+}, 'Verifies that one form used to target multiple frames in succession navigates all of them.');
+
+</script>