Range and Selection: Do not accept offsets larger than 2^31-1.

third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html

Index: third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html
diff --git a/third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html b/third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html
index f050381c14d2c5fe147c4de5b73dec3724d9e869..97ec0077d632ca90ddc9fe42144cb0d56d651e6e 100644
--- a/third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html
+++ b/third_party/WebKit/LayoutTests/fast/text/selection-exceptions.html
@@ -7,22 +7,22 @@
     <script>
         description("This tests that 'Selection' methods throw exceptions with reasonable messages.");
 
-        shouldThrow('getSelection().collapse(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'collapse\' on \'Selection\': There is no child at offset 4294967295."');
+        shouldThrow('getSelection().collapse(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'collapse\' on \'Selection\': The offset 4294967295 is invalid."');
 
         getSelection().empty();
         shouldThrow('getSelection().collapseToStart()', '"InvalidStateError: Failed to execute \'collapseToStart\' on \'Selection\': there is no selection."');
         shouldThrow('getSelection().collapseToEnd()', '"InvalidStateError: Failed to execute \'collapseToEnd\' on \'Selection\': there is no selection."');
 
-        shouldThrow('getSelection().setBaseAndExtent(document.documentElement, -1, document.documentElement, 0)', '"IndexSizeError: Failed to execute \'setBaseAndExtent\' on \'Selection\': There is no child at offset 4294967295."');
-        shouldThrow('getSelection().setBaseAndExtent(document.documentElement, 0, document.documentElement, -1)', '"IndexSizeError: Failed to execute \'setBaseAndExtent\' on \'Selection\': There is no child at offset 4294967295."');
+        shouldThrow('getSelection().setBaseAndExtent(document.documentElement, -1, document.documentElement, 0)', '"IndexSizeError: Failed to execute \'setBaseAndExtent\' on \'Selection\': The offset 4294967295 is invalid."');
+        shouldThrow('getSelection().setBaseAndExtent(document.documentElement, 0, document.documentElement, -1)', '"IndexSizeError: Failed to execute \'setBaseAndExtent\' on \'Selection\': The offset 4294967295 is invalid."');
 
-        shouldThrow('getSelection().collapse(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'collapse\' on \'Selection\': There is no child at offset 4294967295."');
+        shouldThrow('getSelection().collapse(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'collapse\' on \'Selection\': The offset 4294967295 is invalid."');
 
         shouldThrow('getSelection().getRangeAt(-1)', '"IndexSizeError: Failed to execute \'getRangeAt\' on \'Selection\': 4294967295 is not a valid index."');
 
         shouldThrow('getSelection().extend(0, -1)', '"TypeError: Failed to execute \'extend\' on \'Selection\': parameter 1 is not of type \'Node\'."');
         getSelection().addRange(document.createRange());
-        shouldThrow('getSelection().extend(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'extend\' on \'Selection\': There is no child at offset 4294967295."');
+        shouldThrow('getSelection().extend(document.documentElement, -1)', '"IndexSizeError: Failed to execute \'extend\' on \'Selection\': The offset 4294967295 is invalid."');
         shouldThrow('getSelection().extend(document.documentElement, 1000)', '"IndexSizeError: Failed to execute \'extend\' on \'Selection\': There is no child at offset 1000."');
     </script>
 </body>