Limit the heading level to 1 - 9.

Source/modules/accessibility/AXNodeObject.cpp

 /*
 * Copyright (C) 2012, Google Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 860 matching lines @@
     return true;
 }
 
 int AXNodeObject::headingLevel() const
 {
     // headings can be in block flow and non-block flow
     Node* node = this->node();
     if (!node)
         return 0;
 
-    if (roleValue() == HeadingRole && hasAttribute(aria_levelAttr))
-        return getAttribute(aria_levelAttr).toInt();
+    if (roleValue() == HeadingRole && hasAttribute(aria_levelAttr)) {
+        int level = getAttribute(aria_levelAttr).toInt();
+        if (level >= 1 && level <= 9)
+            return level;
+    }
 
     if (!node->isHTMLElement())
         return 0;
 
     HTMLElement& element = toHTMLElement(*node);
     if (element.hasTagName(h1Tag))
         return 1;
 
     if (element.hasTagName(h2Tag))
         return 2;
@@ skipping 927 matching lines @@
     float range = maxValueForRange() - minValueForRange();
     float value = valueForRange();
 
     value += range * (percentChange / 100);
     setValue(String::number(value));
 
     axObjectCache()->postNotification(node(), AXObjectCacheImpl::AXValueChanged, true);
 }
 
 } // namespace blink