Fix to Handle downkey event on last and first radio button of a radio button list

Source/core/html/forms/RadioInputType.cpp

 /*
  * Copyright (C) 2005, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 75 matching lines @@
     // (and so moves to the right). Seems strange, but we'll match it. However,
     // when using Spatial Navigation, we need to be able to navigate without
     // changing the selection.
     Document& document = element().document();
     if (isSpatialNavigationEnabled(document.frame()))
         return;
     bool forward = (key == "Down" || key == "Right");
 
     // We can only stay within the form's children if the form hasn't been demoted to a leaf because
     // of malformed HTML.
-    for (HTMLElement* htmlElement = nextElement(element(), forward); htmlElement; htmlElement = nextElement(*htmlElement, forward)) {
-        // Once we encounter a form element, we know we're through.
-        if (isHTMLFormElement(*htmlElement))
-            break;
+    for (HTMLElement* htmlElement = nextElement(element(), forward);  ; htmlElement = nextElement(*htmlElement, forward)) {
+        // Once we encounter no element or an input element of ootside this form or form element in backward traversal, we know we're through.
+        if (!htmlElement || (isHTMLInputElement(*htmlElement) && toHTMLInputElement(htmlElement)->form() != element().form()) || isHTMLFormElement(*htmlElement)) {

[Habib Virji, 2014/09/10 09:31:52]

If htmlElement is null, this line will result in crash. Just try without radio
group and you will see the crash

+            // Traverse in reverse direction for any radio button
+            forward = !(forward);
+            htmlElement = &element();
+            HTMLElement* nextHtmlElement = nextElement(*htmlElement, forward);
+            HTMLInputElement* inputElement;
+            while (!isHTMLFormElement(*nextHtmlElement) && nextHtmlElement) {

[Habib Virji, 2014/09/10 09:31:52]

is this loop necessary and should not nextHTMLElement be first condition that
you check, because if it is null it will avoid isHTMLFormElement

+                if (isHTMLInputElement(*nextHtmlElement)) {
+                    inputElement = toHTMLInputElement(nextHtmlElement);
+                    if (inputElement->form() == element().form() && inputElement->isRadioButton() && inputElement->name() == element().name() && inputElement->isFocusable())

[Habib Virji, 2014/09/10 09:31:52]

Should not there be a break, if we found the radio element. Based on your logic,
we are traversing back, when we press right or down key, how do we make sure we
land after option 4 to option 1.

+                        htmlElement = nextHtmlElement;
+                }
+                nextHtmlElement = nextElement(*nextHtmlElement, forward);
+            }
+        }
+
         // Look for more radio buttons.
         if (!isHTMLInputElement(*htmlElement))
             continue;
         HTMLInputElement* inputElement = toHTMLInputElement(htmlElement);
         if (inputElement->form() != element().form())
             break;
         if (inputElement->isRadioButton() && inputElement->name() == element().name() && inputElement->isFocusable()) {
             RefPtrWillBeRawPtr<HTMLInputElement> protector(inputElement);
             document.setFocusedElement(inputElement);
             inputElement->dispatchSimulatedClick(event, SendNoEvents);
@@ skipping 84 matching lines @@
 {
     return true;
 }
 
 bool RadioInputType::supportsIndeterminateAppearance() const
 {
     return false;
 }
 
 } // namespace blink