Enforce HTML range restriction on setting unsigned attribute values.

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 2832 matching lines @@
     setAttribute(attributeName, AtomicString::number(value));
 }
 
 unsigned Element::getUnsignedIntegralAttribute(const QualifiedName& attributeName) const
 {
     return getAttribute(attributeName).string().toUInt();
 }
 
 void Element::setUnsignedIntegralAttribute(const QualifiedName& attributeName, unsigned value)
 {
+    // Range restrictions are enforced for unsigned IDL attributes that
+    // reflect content attributes,
+    //   http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#reflecting-content-attributes-in-idl-attributes
+    if (value > 0x7fffffffu)
+        value = 0;
     setAttribute(attributeName, AtomicString::number(value));
 }
 
 double Element::getFloatingPointAttribute(const QualifiedName& attributeName, double fallbackValue) const
 {
     return parseToDoubleForNumberType(getAttribute(attributeName), fallbackValue);
 }
 
 void Element::setFloatingPointAttribute(const QualifiedName& attributeName, double value)
 {
@@ skipping 762 matching lines @@
     // Before doing so, we need to resolve issues in HTMLSelectElement::recalcListItems
     // and RenderMenuList::setText. See also https://bugs.webkit.org/show_bug.cgi?id=88405
     if (hasTagName(optionTag) || hasTagName(optgroupTag))
         return false;
     if (FullscreenElementStack::isActiveFullScreenElement(this))
         return false;
     return true;
 }
 
 } // namespace WebCore