INPUT element: stepDown() should not try to set an out-of-bound value.

third_party/WebKit/Source/core/html/forms/InputType.cpp

Index: third_party/WebKit/Source/core/html/forms/InputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/InputType.cpp b/third_party/WebKit/Source/core/html/forms/InputType.cpp
index fd8731fbf506039d5a0a0e2711df2ef4f7fcd88b..8aa3a4a9274f9b36b6e5790d1aa81875bfd371f8 100644
--- a/third_party/WebKit/Source/core/html/forms/InputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/InputType.cpp
@@ -738,19 +738,20 @@ void InputType::applyStep(const Decimal& current,
   // then set value to the smallest value that, when subtracted from the step
   // base, is an integral multiple of the allowed value step, and that is more
   // than or equal to minimum.
-  // 8. If the element has a maximum, and value is greater than that maximum,
-  // then set value to the largest value that, when subtracted from the step
-  // base, is an integral multiple of the allowed value step, and that is less
-  // than or equal to maximum.
-  if (newValue > stepRange.maximum()) {
-    newValue = alignedMaximum;
-  } else if (newValue < stepRange.minimum()) {
+  if (newValue < stepRange.minimum()) {
     const Decimal alignedMinimum =
         base + ((stepRange.minimum() - base) / step).ceil() * step;
     DCHECK_GE(alignedMinimum, stepRange.minimum());
     newValue = alignedMinimum;
   }
 
+  // 8. If the element has a maximum, and value is greater than that maximum,
+  // then set value to the largest value that, when subtracted from the step
+  // base, is an integral multiple of the allowed value step, and that is less
+  // than or equal to maximum.
+  if (newValue > stepRange.maximum())
+    newValue = alignedMaximum;
+
   // 9. Let value as string be the result of running the algorithm to convert
   // a number to a string, as defined for the input element's type attribute's
   // current state, on value.