INPUT element: Fix integer overflow in input.stepDown().

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved.
@@ skipping 262 matching lines @@
 
 Decimal HTMLInputElement::findClosestTickMarkValue(const Decimal& value) {
   return m_inputType->findClosestTickMarkValue(value);
 }
 
 void HTMLInputElement::stepUp(int n, ExceptionState& exceptionState) {
   m_inputType->stepUp(n, exceptionState);
 }
 
 void HTMLInputElement::stepDown(int n, ExceptionState& exceptionState) {
-  m_inputType->stepUp(-n, exceptionState);
+  m_inputType->stepUp(-1.0 * n, exceptionState);
 }
 
 void HTMLInputElement::blur() {
   m_inputTypeView->blur();
 }
 
 void HTMLInputElement::defaultBlur() {
   HTMLTextFormControlElement::blur();
 }
 
@@ skipping 1637 matching lines @@
 
 bool HTMLInputElement::hasFallbackContent() const {
   return m_inputTypeView->hasFallbackContent();
 }
 
 void HTMLInputElement::setFilesFromPaths(const Vector<String>& paths) {
   return m_inputType->setFilesFromPaths(paths);
 }
 
 }  // namespace blink