INPUT element: Fix integer overflow in input.stepDown().

third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html

Index: third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html
diff --git a/third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html b/third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html
index 8581c64cabe84e4e5b581f7b28fba325f64f6f5e..68bcbcadb181b6c101453b73f8425f61d086e57e 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/number/number-stepup-stepdown.html
@@ -73,6 +73,9 @@ shouldBe('stepUp("3", null, null, -1)', '"2"');
 shouldBe('stepDown("2", null, null)', '"1"');
 shouldBe('stepDown("1", null, null, 2)', '"-1"');
 shouldBe('stepDown("-1", null, null, -1)', '"0"');
+// According to Web IDL specification, 2147483648 here is converted to
+// -2147483648.  So, stepDown(2147483648) is equivalent to stepUp(2147483648).
+shouldBeEqualToString('stepDown("0", "1", null, 2147483648)', '2147483648');
 debug('Extra arguments');
 shouldBe('input.value = "0"; input.min = null; input.step = null; input.stepUp(1, 2); input.value', '"1"');
 shouldBe('input.value = "1"; input.stepDown(1, 3); input.value', '"0"');