INPUT element: Fix integer overflow in input.stepDown().

third_party/WebKit/Source/core/html/forms/InputType.cpp

Index: third_party/WebKit/Source/core/html/forms/InputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/InputType.cpp b/third_party/WebKit/Source/core/html/forms/InputType.cpp
index 48b12bd20519d52ea049b3720739ab7d795df06f..9e01ffd324155908fee3e7b570e24adc11d02d0b 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/InputType.cpp
@@ -672,7 +672,7 @@ ColorChooserClient* InputType::colorChooserClient() {
 }
 
 void InputType::applyStep(const Decimal& current,
-                          int count,
+                          double count,
                           AnyStepHandling anyStepHandling,
                           TextFieldEventBehavior eventBehavior,
                           ExceptionState& exceptionState) {
@@ -725,7 +725,7 @@ void InputType::applyStep(const Decimal& current,
       --count;
     }
   }
-  newValue = newValue + stepRange.step() * count;
+  newValue = newValue + stepRange.step() * Decimal::fromDouble(count);
 
   if (!equalIgnoringCase(stepString, "any"))
     newValue = stepRange.alignValueForStep(current, newValue);
@@ -768,7 +768,7 @@ StepRange InputType::createStepRange(AnyStepHandling) const {
   return StepRange();
 }
 
-void InputType::stepUp(int n, ExceptionState& exceptionState) {
+void InputType::stepUp(double n, ExceptionState& exceptionState) {
   if (!isSteppable()) {
     exceptionState.throwDOMException(InvalidStateError,
                                      "This form element is not steppable.");