INPUT element: Fix a DCHECK failure in RadioInputType::findNextFocusableRadioButtonInGroup.

third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/html/HTMLInputElement.h"
 
+#include <memory>
 #include "core/dom/Document.h"
+#include "core/events/KeyboardEvent.h"
+#include "core/events/KeyboardEventInit.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/VisualViewport.h"
 #include "core/html/HTMLBodyElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLHtmlElement.h"
 #include "core/html/HTMLOptionElement.h"
 #include "core/html/forms/DateTimeChooser.h"
 #include "core/testing/DummyPageHolder.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include <memory>
 
 namespace blink {
 
 class HTMLInputElementTest : public testing::Test {
  protected:
   Document& document() { return m_pageHolder->document(); }
   HTMLInputElement& testElement() {
     Element* element = document().getElementById("test");
     DCHECK(element);
     return toHTMLInputElement(*element);
@@ skipping 112 matching lines @@
 TEST_F(HTMLInputElementTest, ImageTypeCrash) {
   HTMLInputElement* input = HTMLInputElement::create(document(), false);
   input->setAttribute(HTMLNames::typeAttr, "image");
   input->ensureFallbackContent();
   // Make sure ensurePrimaryContent() recreates UA shadow tree, and updating
   // |value| doesn't crash.
   input->ensurePrimaryContent();
   input->setAttribute(HTMLNames::valueAttr, "aaa");
 }
 
+TEST_F(HTMLInputElementTest, RadioKeyDownDCHECKFailure) {
+  // crbug.com/697286
+  document().body()->setInnerHTML(
+      "<input type=radio name=g><input type=radio name=g>");
+  HTMLInputElement& radio1 =
+      toHTMLInputElement(*document().body()->firstChild());
+  HTMLInputElement& radio2 = toHTMLInputElement(*radio1.nextSibling());
+  radio1.focus();
+  // Make layout-dirty.
+  radio2.setAttribute(HTMLNames::styleAttr, "position:fixed");
+  KeyboardEventInit init;
+  init.setKey("ArrowRight");
+  radio1.defaultEventHandler(new KeyboardEvent("keydown", init));
+  EXPECT_EQ(document().activeElement(), &radio2);
+}
+
 TEST_F(HTMLInputElementTest, DateTimeChooserSizeParamRespectsScale) {
   document().view()->frame().page()->visualViewport().setScale(2.f);
   document().body()->setInnerHTML(
       "<input type='date' style='width:200px;height:50px' />");
   document().view()->updateAllLifecyclePhases();
   HTMLInputElement* input = toHTMLInputElement(document().body()->firstChild());
 
   DateTimeChooserParameters params;
   bool success = input->setupDateTimeChooserParameters(params);
   EXPECT_TRUE(success);
   EXPECT_EQ("date", params.type);
   EXPECT_EQ(IntRect(16, 16, 400, 100), params.anchorRectInScreen);
 }
 
 }  // namespace blink