INPUT element: Fix integer overflow in input.stepDown().

third_party/WebKit/Source/core/html/forms/InputType.h

Index: third_party/WebKit/Source/core/html/forms/InputType.h
diff --git a/third_party/WebKit/Source/core/html/forms/InputType.h b/third_party/WebKit/Source/core/html/forms/InputType.h
index 54529a7ceeb9447c7df907ed5064e79b5320b8ba..666238e41c4ee12f7d339c941b1c137db18b8176 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.h
+++ b/third_party/WebKit/Source/core/html/forms/InputType.h
@@ -139,7 +139,7 @@ class CORE_EXPORT InputType : public GarbageCollectedFinalized<InputType> {
   bool stepMismatch(const String&) const;
   virtual bool getAllowedValueStep(Decimal*) const;
   virtual StepRange createStepRange(AnyStepHandling) const;
-  virtual void stepUp(int, ExceptionState&);
+  virtual void stepUp(double, ExceptionState&);
   virtual void stepUpFromLayoutObject(int);
   virtual String badInputText() const;
   virtual String rangeOverflowText(const Decimal& maximum) const;
@@ -252,7 +252,7 @@ class CORE_EXPORT InputType : public GarbageCollectedFinalized<InputType> {
   // Helper for stepUp()/stepDown(). Adds step value * count to the current
   // value.
   void applyStep(const Decimal&,
-                 int count,
+                 double count,
                  AnyStepHandling,
                  TextFieldEventBehavior,
                  ExceptionState&);