//components/password_manager/core/browser/form_parsing/form_parser.cc contains #ifdefs for OS_IOS, and after https://crrev.com/c/1279202 there is likely going to be differences in how FormFieldData looks on iOS compared to the rest.

We do have fuzzers for PasswordForm parsing, but the fuzzing infrastructure does not run on iOS, so the fuzzers need to run on Linux.

This means that the iOS-specific parts of the parsing never get fuzzed.

This affects both the iOS-specific parts of form_parser.cc, and the ios_form_parser.cc. The latter is going away soon, though, so this is mainly about the former.

The possible steps forward include:
 (1) Removing the differences in what FormFieldData is and how it is used on iOS vs. the rest.
 (2) Have fuzzers compiled on iOS.
 (3) Accept this issue and do nothing.

Notes:
(1) Seems unlikely: for example, outside of iOS, where we can use Blink, Chrome makes use of Blink-assigned unique renderer IDs to fill values into forms. On iOS, the (modified) ID attribute is used instead (this is the above mentioned difference), and this will not change as long as WKWebView will not support the unique renderer IDs (highly unlikely).

(2) I have no idea how likely this is, but I have not heard of any plans in this direction.

(3) The actual difference is so small that the missing fuzzing is unlikely to have significant consequences.


[1] https://chromium.googlesource.com/chromium/src/+/HEAD/components/password_manager/core/browser/form_parsing/form_parser.cc#524