Delay to apply |checked| attribute only if the document has form state to be restored.

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
@@ skipping 678 matching lines @@
         m_needsToUpdateViewValue = true;
         setNeedsValidityCheck();
         m_valueAttributeWasUpdatedAfterParsing = !m_parsingInProgress;
         m_inputType->warnIfValueIsInvalidAndElementIsVisible(value);
         m_inputTypeView->valueAttributeChanged();
     } else if (name == checkedAttr) {
         // Another radio button in the same group might be checked by state
         // restore. We shouldn't call setChecked() even if this has the checked
         // attribute. So, delay the setChecked() call until
         // finishParsingChildren() is called if parsing is in progress.
-        if (!m_parsingInProgress && !m_dirtyCheckedness) {
+        if ((!m_parsingInProgress || !document().formController().hasFormStates()) && !m_dirtyCheckedness) {
             setChecked(!value.isNull());
             m_dirtyCheckedness = false;
         }
         pseudoStateChanged(CSSSelector::PseudoDefault);
     } else if (name == maxlengthAttr) {
         parseMaxLengthAttribute(value);
     } else if (name == minlengthAttr) {
         parseMinLengthAttribute(value);
     } else if (name == sizeAttr) {
         int oldSize = m_size;
@@ skipping 1196 matching lines @@
 void HTMLInputElement::ensurePrimaryContent()
 {
     m_inputTypeView->ensurePrimaryContent();
 }
 
 bool HTMLInputElement::hasFallbackContent() const
 {
     return m_inputTypeView->hasFallbackContent();
 }
 } // namespace blink