Merge 130717 - HTMLSelectElement::typeAheadFind depends on implementation dependent behavior

Merge 130717 - HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
https://bugs.webkit.org/show_bug.cgi?id=98710

Reviewed by Kent Tamura.

Source/WebCore:

This patch gets rid of C/C++ implementation dependent behavior from
HTMLSelectElement::typeAheadFind() which does modulo operation with
a negative operand.

HTMLSelectElement::typeAheadFind() contains expression with modulo
operator and dividend can be -1 when the "select" element without
"option" element but "optgroup" element.

Test: fast/forms/select/select-typeahead-crash.html

* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
operation with both operands are non-negative.

LayoutTests:

This patch adds a test for checking HTMLSelectElement::typeAheadFind
doesn't crash.

* fast/forms/select/select-typeahead-crash-expected.txt: Added.
* fast/forms/select/select-typeahead-crash.html: Added.

TBR=yosin@chromium.org
Committed: https://trac.webkit.org/changeset/130719