Merge 59950 - WebCore: Fix for <rdar://problem/8009118> Crash in WebCore::toA...

Merge 59950 - WebCore: Fix for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 
while running MangleMe
and corresponding
https://bugs.webkit.org/show_bug.cgi?id=39508

Reviewed by Darin Adler.

The math was slightly off here, and we wound up trying to access an 
array at index 1 in some cases. We need to decrement numberShadow 
rather than subtracting one from the result of the modulo 
operation.

* rendering/RenderListMarker.cpp:
(WebCore::toAlphabeticOrNumeric):

LayoutTests: Test for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 
while running MangleMe
and corresponding
https://bugs.webkit.org/show_bug.cgi?id=39508

Reviewed by Darin Adler.

* fast/lists/alphaboundaryvalues.html: Added.
* platform/mac/fast/lists/alphaboundaryvaluesexpected.checksum: Added.
* platform/mac/fast/lists/alphaboundaryvaluesexpected.png: Added.
* platform/mac/fast/lists/alphaboundaryvaluesexpected.txt: Added.



TBR=bdakin@apple.com
BUG=44955
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=48100