Fix behavior of HTMLInputElement.maxLength/minLength getter

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLInputElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
index b516a88512ac7f75842d34bffa22692d14b3cb04..110496672c770ea3390a3a8e0318957aa0c6ddc8 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
@@ -103,7 +103,7 @@ HTMLInputElement::HTMLInputElement(Document& document, HTMLFormElement* form, bo
     : HTMLTextFormControlElement(inputTag, document, form)
     , m_size(defaultSize)
     , m_maxLength(maximumLength)
-    , m_minLength(0)
+    , m_minLength(-1)
     , m_maxResults(-1)
     , m_isChecked(false)
     , m_reflectsCheckedAttribute(true)
@@ -1365,6 +1365,8 @@ const AtomicString& HTMLInputElement::alt() const
 
 int HTMLInputElement::maxLength() const
 {
+    if (!hasAttribute(maxlengthAttr))
+        return -1;
     return m_maxLength;
 }
 
@@ -1693,10 +1695,8 @@ void HTMLInputElement::parseMaxLengthAttribute(const AtomicString& value)
 void HTMLInputElement::parseMinLengthAttribute(const AtomicString& value)
 {
     int minLength;
-    if (!parseHTMLInteger(value, minLength))
-        minLength = 0;
-    if (minLength < 0)
-        minLength = 0;
+    if (!parseHTMLInteger(value, minLength) || minLength < 0)

[tkent, 2016/02/12 01:55:09]

We need to reset m_minLength to -1 if we had a parse error.

+        return;
     m_minLength = minLength;
     setNeedsValidityCheck();
 }