Fix an assertion failure in InputType::applyStep()

third_party/WebKit/Source/core/html/forms/InputType.cpp

Index: third_party/WebKit/Source/core/html/forms/InputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/InputType.cpp b/third_party/WebKit/Source/core/html/forms/InputType.cpp
index 5e88d20f06163d16beb9455f7b7881d317176e4a..4144964b1bafe54d316c233652aa570ba3f01c52 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/InputType.cpp
@@ -747,13 +747,12 @@ void InputType::applyStep(const Decimal& current, int count, AnyStepHandling any
     // greater than or equal to the element's minimum and less than or equal to
     // the element's maximum that, when subtracted from the step base, is an
     // integral multiple of the allowed value step, then abort these steps.
-    const Decimal base = stepRange.stepBase();
-    const Decimal step = stepRange.step();
-    const Decimal alignedMaximum = base + ((stepRange.maximum() - base) / step).floor() * step;
-    ASSERT(alignedMaximum <= stepRange.maximum());
-    if (alignedMaximum < stepRange.minimum())
+    Decimal alignedMaximum = stepRange.stepSnappedMaximum();
+    if (!alignedMaximum.isFinite())
         return;
 
+    Decimal base = stepRange.stepBase();
+    Decimal step = stepRange.step();
     EventQueueScope scope;
     Decimal newValue = current;
     const AtomicString& stepString = element().fastGetAttribute(stepAttr);