INPUT element: Fix a DCHECK failure in RadioInputType::findNextFocusableRadioButtonInGroup.

third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp

Index: third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
index e6e8ffdb9a19fa9c3c05441d37403da56be4aeb1..3926038cc0fd5d1c0de8b0695d4c1172fbd685d1 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
@@ -4,7 +4,10 @@
 
 #include "core/html/HTMLInputElement.h"
 
+#include <memory>
 #include "core/dom/Document.h"
+#include "core/events/KeyboardEvent.h"
+#include "core/events/KeyboardEventInit.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/VisualViewport.h"
@@ -15,7 +18,6 @@
 #include "core/html/forms/DateTimeChooser.h"
 #include "core/testing/DummyPageHolder.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include <memory>
 
 namespace blink {
 
@@ -148,6 +150,22 @@ TEST_F(HTMLInputElementTest, ImageTypeCrash) {
   input->setAttribute(HTMLNames::valueAttr, "aaa");
 }
 
+TEST_F(HTMLInputElementTest, RadioKeyDownDCHECKFailure) {
+  // crbug.com/697286
+  document().body()->setInnerHTML(
+      "<input type=radio name=g><input type=radio name=g>");
+  HTMLInputElement& radio1 =
+      toHTMLInputElement(*document().body()->firstChild());
+  HTMLInputElement& radio2 = toHTMLInputElement(*radio1.nextSibling());
+  radio1.focus();
+  // Make layout-dirty.
+  radio2.setAttribute(HTMLNames::styleAttr, "position:fixed");
+  KeyboardEventInit init;
+  init.setKey("ArrowRight");
+  radio1.defaultEventHandler(new KeyboardEvent("keydown", init));
+  EXPECT_EQ(document().activeElement(), &radio2);
+}
+
 TEST_F(HTMLInputElementTest, DateTimeChooserSizeParamRespectsScale) {
   document().view()->frame().page()->visualViewport().setScale(2.f);
   document().body()->setInnerHTML(