Fix to Handle downkey event on last and first radio button of a radio button list

Source/core/html/forms/RadioInputType.cpp

Index: Source/core/html/forms/RadioInputType.cpp
diff --git a/Source/core/html/forms/RadioInputType.cpp b/Source/core/html/forms/RadioInputType.cpp
index 4e992f650156e2874b2a8c1e9af574347c232a5a..2273243556875910b6c171949fd9ec002008a898 100644
--- a/Source/core/html/forms/RadioInputType.cpp
+++ b/Source/core/html/forms/RadioInputType.cpp
@@ -93,10 +93,24 @@ void RadioInputType::handleKeydownEvent(KeyboardEvent* event)
 
     // We can only stay within the form's children if the form hasn't been demoted to a leaf because
     // of malformed HTML.
-    for (HTMLElement* htmlElement = nextElement(element(), forward); htmlElement; htmlElement = nextElement(*htmlElement, forward)) {
-        // Once we encounter a form element, we know we're through.
-        if (isHTMLFormElement(*htmlElement))
-            break;
+    for (HTMLElement* htmlElement = nextElement(element(), forward);  ; htmlElement = nextElement(*htmlElement, forward)) {
+        // Once we encounter no element or an input element of ootside this form or form element in backward traversal, we know we're through.
+        if (!htmlElement || (isHTMLInputElement(*htmlElement) && toHTMLInputElement(htmlElement)->form() != element().form()) || isHTMLFormElement(*htmlElement)) {

[Habib Virji, 2014/09/10 09:31:52]

If htmlElement is null, this line will result in crash. Just try without radio
group and you will see the crash

+            // Traverse in reverse direction for any radio button
+            forward = !(forward);
+            htmlElement = &element();
+            HTMLElement* nextHtmlElement = nextElement(*htmlElement, forward);
+            HTMLInputElement* inputElement;
+            while (!isHTMLFormElement(*nextHtmlElement) && nextHtmlElement) {

[Habib Virji, 2014/09/10 09:31:52]

is this loop necessary and should not nextHTMLElement be first condition that
you check, because if it is null it will avoid isHTMLFormElement

+                if (isHTMLInputElement(*nextHtmlElement)) {
+                    inputElement = toHTMLInputElement(nextHtmlElement);
+                    if (inputElement->form() == element().form() && inputElement->isRadioButton() && inputElement->name() == element().name() && inputElement->isFocusable())

[Habib Virji, 2014/09/10 09:31:52]

Should not there be a break, if we found the radio element. Based on your logic,
we are traversing back, when we press right or down key, how do we make sure we
land after option 4 to option 1.

+                        htmlElement = nextHtmlElement;
+                }
+                nextHtmlElement = nextElement(*nextHtmlElement, forward);
+            }
+        }
+
         // Look for more radio buttons.
         if (!isHTMLInputElement(*htmlElement))
             continue;