Range and Selection: Do not accept offsets larger than 2^31-1.

third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt

Index: third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt
diff --git a/third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt b/third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt
index 197a56d2469e28765b84c96ecb0796121b405c50..63039c6d7854ad204091870d0b1c5831f82e765a 100644
--- a/third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/text/selection-exceptions-expected.txt
@@ -3,15 +3,15 @@ This tests that 'Selection' methods throw exceptions with reasonable messages.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS getSelection().collapse(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'collapse' on 'Selection': There is no child at offset 4294967295..
+PASS getSelection().collapse(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'collapse' on 'Selection': The offset 4294967295 is invalid..
 PASS getSelection().collapseToStart() threw exception InvalidStateError: Failed to execute 'collapseToStart' on 'Selection': there is no selection..
 PASS getSelection().collapseToEnd() threw exception InvalidStateError: Failed to execute 'collapseToEnd' on 'Selection': there is no selection..
-PASS getSelection().setBaseAndExtent(document.documentElement, -1, document.documentElement, 0) threw exception IndexSizeError: Failed to execute 'setBaseAndExtent' on 'Selection': There is no child at offset 4294967295..
-PASS getSelection().setBaseAndExtent(document.documentElement, 0, document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'setBaseAndExtent' on 'Selection': There is no child at offset 4294967295..
-PASS getSelection().collapse(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'collapse' on 'Selection': There is no child at offset 4294967295..
+PASS getSelection().setBaseAndExtent(document.documentElement, -1, document.documentElement, 0) threw exception IndexSizeError: Failed to execute 'setBaseAndExtent' on 'Selection': The offset 4294967295 is invalid..
+PASS getSelection().setBaseAndExtent(document.documentElement, 0, document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'setBaseAndExtent' on 'Selection': The offset 4294967295 is invalid..
+PASS getSelection().collapse(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'collapse' on 'Selection': The offset 4294967295 is invalid..
 PASS getSelection().getRangeAt(-1) threw exception IndexSizeError: Failed to execute 'getRangeAt' on 'Selection': 4294967295 is not a valid index..
 PASS getSelection().extend(0, -1) threw exception TypeError: Failed to execute 'extend' on 'Selection': parameter 1 is not of type 'Node'..
-PASS getSelection().extend(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'extend' on 'Selection': There is no child at offset 4294967295..
+PASS getSelection().extend(document.documentElement, -1) threw exception IndexSizeError: Failed to execute 'extend' on 'Selection': The offset 4294967295 is invalid..
 PASS getSelection().extend(document.documentElement, 1000) threw exception IndexSizeError: Failed to execute 'extend' on 'Selection': There is no child at offset 1000..
 PASS successfullyParsed is true