Chrome Version       : tip-of-tree (commit a646eeb201fa815800f259a37c61cc8b557423ba)
OS Version: Linux
URLs (if applicable) : https://rsolomakhin.github.io/pr/us/

What steps will reproduce the problem?
1. Open https://rsolomakhin.github.io/pr/us/
2. Click [Buy] on the page.
3. Click [Select] in the Shipping Address section of the payment sheet.
4. Click on a pencil icon next to an existing address.
5. Tap the "Enter" key on the keyboard.

What is the expected result?
The address is saved.

What happens instead of that?
Crash.

Please provide any additional information below. Attach a screenshot if
possible.

Stack trace:

Received signal 11 <unknown> 000000000000                                                                                                                                                                                                
#0 0x7f3100b916ad base::debug::StackTrace::StackTrace()                                                                                                                   
#1 0x7f3100b8fb9c base::debug::StackTrace::StackTrace()                                     
#2 0x7f3100b91075 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7f31010f40c0 <unknown>                                                                                                                                       
#4 0x55ea89250cce payments::PaymentRequestRowView::ShowBottomSeparator()                                                                                                  
#5 0x55ea892513c3 payments::PaymentRequestRowView::SetIsHighlighted()                                                                                                                                                                                      
#6 0x55ea89251449 payments::PaymentRequestRowView::StateChanged()                                                                                                           
#7 0x7f30f2e88227 views::Button::SetState()                 
#8 0x7f30f2e89706 views::Button::ViewHierarchyChanged() 
#9 0x7f30f2f7981d views::View::ViewHierarchyChangedImpl()        
#10 0x7f30f2f88825 views::View::PropagateRemoveNotifications()
#11 0x7f30f2f78301 views::View::DoRemoveChildView()                 
#12 0x7f30f2f79c2d views::View::RemoveAllChildViews()      
#13 0x55ea89254695 payments::PaymentRequestSheetController::UpdateContentView()                           
#14 0x55ea8926885e payments::PaymentSheetViewController::OnSelectedInformationChanged()                       
#15 0x55ea89888836 payments::PaymentRequestState::NotifyOnSelectedInformationChanged()                                                                                                                            
#16 0x55ea898858cd payments::PaymentRequestState::UpdateIsReadyToPayAndNotifyObservers()                                                           
#17 0x55ea89885877 payments::PaymentRequestState::OnSpecUpdated()
#18 0x55ea8987a8c6 payments::PaymentRequestSpec::NotifyOnSpecUpdated()                  
#19 0x55ea8987a827 payments::PaymentRequestSpec::RecomputeSpecForDetails()                                                                         
#20 0x55ea8987a7f8 payments::PaymentRequestSpec::UpdateWith()                                                                                              
#21 0x55ea898578c7 payments::PaymentRequest::UpdateWith()                                                                                                                                                                                
#22 0x7f30fa394461 payments::mojom::PaymentRequestStubDispatch::Accept()                                                                                                  
#23 0x55ea89859073 payments::mojom::PaymentRequestStub<>::Accept()                          
#24 0x7f30ff111b88 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#25 0x7f30ff1105f1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#26 0x7f30ff10eaa2 mojo::FilterChain::Accept()
#27 0x7f30ff114795 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#28 0x7f30ff120cfb mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#29 0x7f30ff120245 mojo::internal::MultiplexRouter::Accept()
#30 0x7f30ff10eaa2 mojo::FilterChain::Accept()
#31 0x7f30ff100a8f mojo::Connector::ReadSingleMessage()
#32 0x7f30ff101aca mojo::Connector::ReadAllAvailableMessages()
#33 0x7f30ff101892 mojo::Connector::OnHandleReadyInternal()
#34 0x7f30ff10177b mojo::Connector::OnWatcherHandleReady()