Handle overflow, underflow in XPath substring position, length.

third_party/WebKit/Source/core/xml/XPathFunctions.h

Index: third_party/WebKit/Source/core/xml/XPathFunctions.h
diff --git a/third_party/WebKit/Source/core/xml/XPathFunctions.h b/third_party/WebKit/Source/core/xml/XPathFunctions.h
index 8c88a3f299054b2c90d3ccb72a5ad38fd558f49a..d00de20d7f516eaabeef1302bd64bdf33e390701 100644
--- a/third_party/WebKit/Source/core/xml/XPathFunctions.h
+++ b/third_party/WebKit/Source/core/xml/XPathFunctions.h
@@ -27,13 +27,14 @@
 #ifndef XPathFunctions_h
 #define XPathFunctions_h
 
+#include "core/CoreExport.h"
 #include "core/xml/XPathExpressionNode.h"
 
 namespace blink {
 
 namespace XPath {
 
-class Function : public Expression {
+class CORE_EXPORT Function : public Expression {
  public:
   void setArguments(HeapVector<Member<Expression>>&);
   void setName(const String& name) { m_name = name; }
@@ -49,7 +50,8 @@ class Function : public Expression {
 };
 
 Function* createFunction(const String& name);
-Function* createFunction(const String& name, HeapVector<Member<Expression>>&);
+CORE_EXPORT Function* createFunction(const String& name,
+                                     HeapVector<Member<Expression>>&);
 
 }  // namespace XPath