Fix failed check with negative step attribute

Fixes a clusterfuzz crash with a large value for an <input>'s step. Fixed: 1310229 Test: out/Default/blink_unittests --gtest_filter='StepRange*' Change-Id: I6c7396853bedd653594123e0693c66c4d1f22e50 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3579961 Reviewed-by: Joey Arhar <jarhar@chromium.org> Commit-Queue: Joey Arhar <jarhar@chromium.org> Cr-Commit-Position: refs/heads/main@{#991074}
web-platform-tests · Apr 11, 2022 · 0e35388 · 0e35388
1 parent bc0c1c7
commit 0e35388
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/html/semantics/forms/the-input-element/large-step-crash.html b/html/semantics/forms/the-input-element/large-step-crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1310229">
+<script>
+const input = document.createElement('input');
+input.type = 'range';
+input.max =  "06146014076123948948236985915694585937453938739248525313667193356954648912174625325457686181245605159230507050382951965923880139416566171456307667108838599671206701390275757535304375074544995161254818024615";
+input.step = "55244276720723476767813103100759083382064508394993167470137";
+input.stepUp();
+</script>