Limit the heading level to 1 - 9.

Source/modules/accessibility/AXNodeObject.cpp

Index: Source/modules/accessibility/AXNodeObject.cpp
diff --git a/Source/modules/accessibility/AXNodeObject.cpp b/Source/modules/accessibility/AXNodeObject.cpp
index 151bb67176eda090b410c3d42c3c3fd1d72b8158..75391ace61416df7ed6ae348a5e8fe9ba7d161a0 100644
--- a/Source/modules/accessibility/AXNodeObject.cpp
+++ b/Source/modules/accessibility/AXNodeObject.cpp
@@ -878,8 +878,11 @@ int AXNodeObject::headingLevel() const
     if (!node)
         return 0;
 
-    if (roleValue() == HeadingRole && hasAttribute(aria_levelAttr))
-        return getAttribute(aria_levelAttr).toInt();
+    if (roleValue() == HeadingRole && hasAttribute(aria_levelAttr)) {
+        int level = getAttribute(aria_levelAttr).toInt();
+        if (level >= 1 && level <= 9)
+            return level;
+    }
 
     if (!node->isHTMLElement())
         return 0;