Handle overflow, underflow in XPath substring position, length.

third_party/WebKit/Source/core/xml/XPathPredicate.h

Index: third_party/WebKit/Source/core/xml/XPathPredicate.h
diff --git a/third_party/WebKit/Source/core/xml/XPathPredicate.h b/third_party/WebKit/Source/core/xml/XPathPredicate.h
index 6dadee9b6b80009ef64e8d3e790640380cbbef1a..da44c9bfe2d158c19ad11c1dea3cc0616a1dcb34 100644
--- a/third_party/WebKit/Source/core/xml/XPathPredicate.h
+++ b/third_party/WebKit/Source/core/xml/XPathPredicate.h
@@ -27,6 +27,7 @@
 #ifndef XPathPredicate_h
 #define XPathPredicate_h
 
+#include "core/CoreExport.h"
 #include "core/xml/XPathExpressionNode.h"
 #include "core/xml/XPathValue.h"
 
@@ -34,7 +35,7 @@ namespace blink {
 
 namespace XPath {
 
-class Number final : public Expression {
+class CORE_EXPORT Number final : public Expression {
  public:
   explicit Number(double);
   DECLARE_VIRTUAL_TRACE();
@@ -46,7 +47,7 @@ class Number final : public Expression {
   Value m_value;
 };
 
-class StringExpression final : public Expression {
+class CORE_EXPORT StringExpression final : public Expression {
  public:
   explicit StringExpression(const String&);
   DECLARE_VIRTUAL_TRACE();