2009-10-06 Kent Tamura <tkent@chromium.org>

        Reviewed by Darin Adler.

        Implement min/max attributes, ValidityState.rangeUnderflow and
        ValidityState.rangeOverflow for <input type=number> and <input type=range>
        https://bugs.webkit.org/show_bug.cgi?id=29069

        * fast/forms/ValidityState-rangeOverflow-number-expected.txt: Added.
        * fast/forms/ValidityState-rangeOverflow-number.html: Added.
        * fast/forms/ValidityState-rangeOverflow-range-expected.txt: Added.
        * fast/forms/ValidityState-rangeOverflow-range.html: Added.
        * fast/forms/ValidityState-rangeUnderflow-number-expected.txt: Added.
        * fast/forms/ValidityState-rangeUnderflow-number.html: Added.
        * fast/forms/ValidityState-rangeUnderflow-range-expected.txt: Added.
        * fast/forms/ValidityState-rangeUnderflow-range.html: Added.
        * fast/forms/input-minmax-expected.txt: Added.
        * fast/forms/input-minmax.html: Added.
        * fast/forms/script-tests/ValidityState-rangeOverflow-number.js: Added.
        * fast/forms/script-tests/ValidityState-rangeOverflow-range.js: Added.
        * fast/forms/script-tests/ValidityState-rangeUnderflow-number.js: Added.
        * fast/forms/script-tests/ValidityState-rangeUnderflow-range.js: Added.
        * fast/forms/script-tests/input-minmax.js: Added.
2009-10-06  Kent Tamura  <tkent@chromium.org>

        Reviewed by Darin Adler.

        Implement min/max attributes, ValidityState.rangeUnderflow and
        ValidityState.rangeOverflow for <input type=number> and <input type=range>
        https://bugs.webkit.org/show_bug.cgi?id=29069

        HTMLInputElement::max and min are not defined for COM because they
        conflict with the standard min() and max() macros.

        Tests: fast/forms/ValidityState-rangeOverflow-number.html
               fast/forms/ValidityState-rangeOverflow-range.html
               fast/forms/ValidityState-rangeUnderflow-number.html
               fast/forms/ValidityState-rangeUnderflow-range.html
               fast/forms/input-minmax.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::rangeUnderflow):
        (WebCore::HTMLInputElement::rangeOverflow):
        (WebCore::HTMLInputElement::rangeMinimum):
        (WebCore::HTMLInputElement::rangeMaximum):
        * html/HTMLInputElement.h:
        * html/HTMLInputElement.idl:
        * html/ValidityState.cpp:
        (WebCore::ValidityState::rangeUnderflow):
        (WebCore::ValidityState::rangeOverflow):
        * html/ValidityState.h:
        * rendering/RenderSlider.cpp:
        (WebCore::SliderRange::SliderRange):
        (WebCore::SliderRange::valueFromElement):

git-svn-id: svn://svn.chromium.org/blink/trunk@49199 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/ChangeLog

+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        * fast/forms/ValidityState-rangeOverflow-number-expected.txt: Added.
+        * fast/forms/ValidityState-rangeOverflow-number.html: Added.
+        * fast/forms/ValidityState-rangeOverflow-range-expected.txt: Added.
+        * fast/forms/ValidityState-rangeOverflow-range.html: Added.
+        * fast/forms/ValidityState-rangeUnderflow-number-expected.txt: Added.
+        * fast/forms/ValidityState-rangeUnderflow-number.html: Added.
+        * fast/forms/ValidityState-rangeUnderflow-range-expected.txt: Added.
+        * fast/forms/ValidityState-rangeUnderflow-range.html: Added.
+        * fast/forms/input-minmax-expected.txt: Added.
+        * fast/forms/input-minmax.html: Added.
+        * fast/forms/script-tests/ValidityState-rangeOverflow-number.js: Added.
+        * fast/forms/script-tests/ValidityState-rangeOverflow-range.js: Added.
+        * fast/forms/script-tests/ValidityState-rangeUnderflow-number.js: Added.
+        * fast/forms/script-tests/ValidityState-rangeUnderflow-range.js: Added.
+        * fast/forms/script-tests/input-minmax.js: Added.
+
 2009-10-06  Xan Lopez  <xlopez@igalia.com>
 
         Skip new tests for which we are missing expected results.

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeOverflow-number-expected.txt

+This test aims to check for rangeOverflow flag with type=number input fields
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS The value "101" doesn't overflow the maximum value "100".
+PASS The value "99" doesn't overflow the maximum value "100".
+PASS The value "-101" doesn't overflow the maximum value "-100".
+PASS The value "99" doesn't overflow the maximum value "1E+2".
+PASS The value "0.99" doesn't overflow the maximum value "1.00".
+PASS The value "abc" doesn't overflow the maximum value "100".
+PASS The value "" doesn't overflow the maximum value "-1".
+PASS The value "101" doesn't overflow the maximum value "".
+PASS The value "101" doesn't overflow the maximum value "xxx".
+PASS The value "0.999999999999999999999999999999999999999999" doesn't overflow the maximum value "0.999999999999999999999999999999999999999998".
+PASS The value "101" overflows the maximum value "100".
+PASS The value "-99" overflows the maximum value "-100".
+PASS The value "101" overflows the maximum value "1E+2".
+PASS The value "101" overflows the maximum value "100".
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeOverflow-number.html

+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/ValidityState-rangeOverflow-number.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeOverflow-range-expected.txt

+This test aims to check for rangeOverflow flag with type=range input fields
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS The value "101" doesn't overflow the maximum value "100".
+PASS The value "99" doesn't overflow the maximum value "100".
+PASS The value "-101" doesn't overflow the maximum value "-100".
+PASS The value "99" doesn't overflow the maximum value "1E+2".
+PASS The value "0.99" doesn't overflow the maximum value "1.00".
+PASS The value "abc" doesn't overflow the maximum value "100".
+PASS The value "" doesn't overflow the maximum value "-1".
+PASS The value "0.999999999999999999999999999999999999999999" doesn't overflow the maximum value "0.999999999999999999999999999999999999999998".
+PASS The value "101" doesn't overflow the maximum value "100".
+PASS The value "101" overflows the maximum value "100".
+PASS The value "-99" overflows the maximum value "-100".
+PASS The value "101" overflows the maximum value "1E+2".
+PASS The value "101" overflows the maximum value "".
+PASS The value "101" overflows the maximum value "xxx".
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeOverflow-range.html

+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/ValidityState-rangeOverflow-range.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeUnderflow-number-expected.txt

+This test aims to check for rangeUnderflow flag with type=number input fields
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS The value "99" doesn't underflow the minimum value "100".
+PASS The value "101" doesn't underflow the minimum value "100".
+PASS The value "-99" doesn't underflow the minimum value "-100".
+PASS The value "101" doesn't underflow the minimum value "1E+2".
+PASS The value "1.01" doesn't underflow the minimum value "1.00".
+PASS The value "abc" doesn't underflow the minimum value "100".
+PASS The value "" doesn't underflow the minimum value "1".
+PASS The value "-1" doesn't underflow the minimum value "".
+PASS The value "-1" doesn't underflow the minimum value "xxx".
+PASS The value "0.999999999999999999999999999999999999999998" doesn't underflow the minimum value "0.999999999999999999999999999999999999999999".
+PASS The value "99" underflows the minimum value "100".
+PASS The value "-101" underflows the minimum value "-100".
+PASS The value "99" underflows the minimum value "1E+2".
+PASS The value "101" underflows the minimum value "200".
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeUnderflow-number.html

+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/ValidityState-rangeUnderflow-number.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeUnderflow-range-expected.txt

+This test aims to check for rangeUnderflow flag with type=range input fields
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS The value "99" doesn't underflow the minimum value "100".
+PASS The value "101" doesn't underflow the minimum value "100".
+PASS The value "-99" doesn't underflow the minimum value "-100".
+PASS The value "101" doesn't underflow the minimum value "1E+2".
+PASS The value "1.01" doesn't underflow the minimum value "1.00".
+PASS The value "abc" doesn't underflow the minimum value "100".
+PASS The value "" doesn't underflow the minimum value "1".
+PASS The value "0.999999999999999999999999999999999999999998" doesn't underflow the minimum value "0.999999999999999999999999999999999999999999".
+PASS The value "101" doesn't underflow the minimum value "100".
+PASS The value "99" underflows the minimum value "100".
+PASS The value "-101" underflows the minimum value "-100".
+PASS The value "99" underflows the minimum value "1E+2".
+PASS The value "-1" underflows the minimum value "".
+PASS The value "-1" underflows the minimum value "xxx".
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

third_party/WebKit/LayoutTests/fast/forms/ValidityState-rangeUnderflow-range.html

+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/ValidityState-rangeUnderflow-range.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>

third_party/WebKit/LayoutTests/fast/forms/input-minmax-expected.txt

+Tests the behavior of .min and .max of HTMLInputElement.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS input.min is ""
+PASS input.max is ""
+PASS input.min is "0"
+PASS input.max is "100"
+PASS input.min is "abc"
+PASS input.max is "qwerty"
+PASS input.getAttribute("min") is "foo"
+PASS input.getAttribute("max") is "bar"
+PASS input.getAttribute("min") is ""
+PASS input.getAttribute("max") is ""
+PASS input.min is ""
+PASS input.max is ""
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

third_party/WebKit/LayoutTests/fast/forms/input-minmax.html

+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/input-minmax.js"></script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>

third_party/WebKit/LayoutTests/fast/forms/script-tests/ValidityState-rangeOverflow-number.js

+description('This test aims to check for rangeOverflow flag with type=number input fields');
+
+var input = document.createElement('input');
+
+function check(value, max, overflowExpected)
+{
+    input.value = value;
+    input.max = max;
+    var actual = input.validity.rangeOverflow;
+    var didPass = actual == overflowExpected;
+    var resultText = 'The value "' + input.value + '" ' + (actual ? 'overflows' : 'doesn\'t overflow') + ' the maximum value "' + input.max + '".';
+    if (didPass)
+        testPassed(resultText);
+    else
+        testFailed(resultText);
+}
+
+// No overflow cases
+input.type = 'text';  // No overflow for type=text.
+check('101', '100', false);
+input.type = 'number';
+check('99', '100', false);  // Very normal case.
+check('-101', '-100', false);
+check('99', '1E+2', false);
+check('0.99', '1.00', false);
+check('abc', '100', false);  // Invalid value.
+check('', '-1', false);  // No value.
+check('101', '', false);  // No max.
+check('101', 'xxx', false);  // Invalid max.
+// The following case should be rangeOverflow==true ideally.  But the "double" type doesn't have enough precision.
+check('0.999999999999999999999999999999999999999999', '0.999999999999999999999999999999999999999998', false);
+
+// Overflow cases
+check('101', '100', true);
+check('-99', '-100', true);
+check('101', '1E+2', true);
+input.min = '200';  // value < min && value > max
+check('101', '100', true);
+
+var successfullyParsed = true;

third_party/WebKit/LayoutTests/fast/forms/script-tests/ValidityState-rangeOverflow-range.js

+description('This test aims to check for rangeOverflow flag with type=range input fields');
+
+var input = document.createElement('input');
+
+function check(value, max, overflowExpected)
+{
+    input.value = value;
+    input.max = max;
+    var actual = input.validity.rangeOverflow;
+    var didPass = actual == overflowExpected;
+    var resultText = 'The value "' + input.value + '" ' + (actual ? 'overflows' : 'doesn\'t overflow') + ' the maximum value "' + input.max + '".';
+    if (didPass)
+        testPassed(resultText);
+    else
+        testFailed(resultText);
+}
+
+// No overflow cases
+input.type = 'text';  // No overflow for type=text.
+check('101', '100', false);
+input.type = 'range';
+check('99', '100', false);  // Very normal case.
+check('-101', '-100', false);
+check('99', '1E+2', false);
+check('0.99', '1.00', false);
+check('abc', '100', false);  // Invalid value.
+check('', '-1', false);  // No value.
+// The following case should be rangeOverflow==true ideally.  But the "double" type doesn't have enough precision.
+check('0.999999999999999999999999999999999999999999', '0.999999999999999999999999999999999999999998', false);
+input.min = '200';  // If min > max, max is reset to min.
+check('101', '100', false);
+input.min = '';
+
+// Overflow cases
+check('101', '100', true);
+input.min = '-200';
+check('-99', '-100', true);
+input.min = '';
+check('101', '1E+2', true);
+check('101', '', true);  // No max.
+check('101', 'xxx', true);  // Invalid max.
+
+var successfullyParsed = true;

third_party/WebKit/LayoutTests/fast/forms/script-tests/ValidityState-rangeUnderflow-number.js

+description('This test aims to check for rangeUnderflow flag with type=number input fields');
+
+var input = document.createElement('input');
+
+function check(value, min, underflowExpected)
+{
+    input.value = value;
+    input.min = min;
+    var actual = input.validity.rangeUnderflow;
+    var didPass = actual == underflowExpected;
+    var resultText = 'The value "' + input.value + '" ' + (actual ? 'underflows' : 'doesn\'t underflow') + ' the minimum value "' + input.min + '".';
+    if (didPass)
+        testPassed(resultText);
+    else
+        testFailed(resultText);
+}
+
+// No underflow cases
+input.type = 'text';  // No underflow for type=text.
+check('99', '100', false);
+input.type = 'number';
+check('101', '100', false);  // Very normal case.
+check('-99', '-100', false);
+check('101', '1E+2', false);
+check('1.01', '1.00', false);
+check('abc', '100', false);  // Invalid value.
+check('', '1', false);  // No value.
+check('-1', '', false);  // No min.
+check('-1', 'xxx', false);  // Invalid min.
+// The following case should be rangeUnderflow==true ideally.  But the "double" type doesn't have enough precision.
+check('0.999999999999999999999999999999999999999998', '0.999999999999999999999999999999999999999999', false);
+
+// Underflow cases
+check('99', '100', true);
+check('-101', '-100', true);
+check('99', '1E+2', true);
+input.max = '100';  // value < min && value > max
+check('101', '200', true);
+
+var successfullyParsed = true;

third_party/WebKit/LayoutTests/fast/forms/script-tests/ValidityState-rangeUnderflow-range.js

+description('This test aims to check for rangeUnderflow flag with type=range input fields');
+
+var input = document.createElement('input');
+
+function check(value, min, underflowExpected)
+{
+    input.value = value;
+    input.min = min;
+    var actual = input.validity.rangeUnderflow;
+    var didPass = actual == underflowExpected;
+    var resultText = 'The value "' + input.value + '" ' + (actual ? 'underflows' : 'doesn\'t underflow') + ' the minimum value "' + input.min + '".';
+    if (didPass)
+        testPassed(resultText);
+    else
+        testFailed(resultText);
+}
+
+// No underflow cases
+input.type = 'text';  // No overflow for type=text.
+check('99', '100', false);
+input.type = 'range';
+check('101', '100', false);  // Very normal case.
+check('-99', '-100', false);
+check('101', '1E+2', false);
+check('1.01', '1.00', false);
+check('abc', '100', false);  // Invalid value.
+check('', '1', false);  // No value.
+// The following case should be rangeUnderflow==true ideally.  But the "double" type doesn't have enough precision.
+check('0.999999999999999999999999999999999999999998', '0.999999999999999999999999999999999999999999', false);
+input.max = '0';  // If min > max, max is reset to min and min is not changed.
+check('101', '100', false);
+input.max = '';
+
+// Underflow cases
+check('99', '100', true);
+check('-101', '-100', true);
+check('99', '1E+2', true);
+check('-1', '', true);  // No min.
+check('-1', 'xxx', true);  // Invalid min.
+
+var successfullyParsed = true;

third_party/WebKit/LayoutTests/fast/forms/script-tests/input-minmax.js

+description('Tests the behavior of .min and .max of HTMLInputElement.');
+
+var input = document.createElement('input');
+
+// .min and .max just reflect the corresponding attributes.
+input.type = 'text';
+shouldBe('input.min', '""');
+shouldBe('input.max', '""');
+input.setAttribute('min', '0');
+input.setAttribute('max', '100');
+shouldBe('input.min', '"0"');
+shouldBe('input.max', '"100"');
+input.setAttribute('min', 'abc');
+input.setAttribute('max', 'qwerty');
+shouldBe('input.min', '"abc"');
+shouldBe('input.max', '"qwerty"');
+
+input.min = 'foo';
+input.max = 'bar';
+shouldBe('input.getAttribute("min")', '"foo"');
+shouldBe('input.getAttribute("max")', '"bar"');
+input.min = '';
+input.max = '';
+shouldBe('input.getAttribute("min")', '""');
+shouldBe('input.getAttribute("max")', '""');
+
+// The range type has the default minimum and the default maximum.
+// But they aren't exposed by .min .max IDL attributes.
+input.type = 'range';
+input.setAttribute('min', '');
+input.setAttribute('max', '');
+shouldBe('input.min', '""');
+shouldBe('input.max', '""');
+
+var successfullyParsed = true;

third_party/WebKit/WebCore/ChangeLog

+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
 2009-10-06  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Eric Seidel.

third_party/WebKit/WebCore/html/HTMLInputElement.cpp

@@ -232,6 +232,62 @@ bool HTMLInputElement::tooLong() const
     return false;
 }
 
+bool HTMLInputElement::rangeUnderflow() const
+{
+    if (inputType() == NUMBER) {
+        double min = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
+            return doubleValue < min;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue < rangeMinimum();
+    }
+    return false;
+}
+
+bool HTMLInputElement::rangeOverflow() const
+{
+    if (inputType() == NUMBER) {
+        double max = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
+            return doubleValue > max;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue > rangeMaximum();
+    }
+    return false;
+}
+
+double HTMLInputElement::rangeMinimum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default minimum" is 0.
+    double min = 0.0;
+    formStringToDouble(getAttribute(minAttr), &min);
+    return min;
+}
+
+double HTMLInputElement::rangeMaximum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default maximum" is 100.
+    static const double defaultMaximum = 100.0;
+    double max = defaultMaximum;
+    formStringToDouble(getAttribute(maxAttr), &max);
+    const double min = rangeMinimum();
+
+    if (max < min) {
+        // A remedy for the inconsistent min/max values.
+        // Sets the maxmimum to the default (100.0) or the minimum value.
+        max = min < defaultMaximum ? defaultMaximum : min;
+    }
+    return max;
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -705,7 +761,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0) && attached()) {

third_party/WebKit/WebCore/html/HTMLInputElement.h

@@ -94,6 +94,14 @@ public:
     virtual bool valueMissing() const;
     virtual bool patternMismatch() const;
     virtual bool tooLong() const;
+    // For ValidityState
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    // Returns the minimum value for type=range.  Don't call this for other types.
+    double rangeMinimum() const;
+    // Returns the maximum value for type=range.  Don't call this for other types.
+    // This always returns a value which is <= rangeMinimum().
+    double rangeMaximum() const;
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }

third_party/WebKit/WebCore/html/HTMLInputElement.idl

@@ -41,9 +41,15 @@ module html {
                  attribute boolean         autofocus;
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLElement     list;
+#endif
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString max;
 #endif
                  attribute long            maxLength
                      setter raises(DOMException);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString min;
+#endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [Reflect] DOMString       pattern;

third_party/WebKit/WebCore/html/ValidityState.cpp

@@ -60,6 +60,20 @@ bool ValidityState::typeMismatch()
     }
 }
 
+bool ValidityState::rangeUnderflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+}
+
+bool ValidityState::rangeOverflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||

third_party/WebKit/WebCore/html/ValidityState.h

@@ -44,8 +44,8 @@ namespace WebCore {
         bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
         bool tooLong() { return control()->tooLong(); }
-        bool rangeUnderflow() { return false; }
-        bool rangeOverflow() { return false; }
+        bool rangeUnderflow();
+        bool rangeOverflow();
         bool stepMismatch() { return false; }
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();

third_party/WebKit/WebCore/rendering/RenderSlider.cpp

@@ -50,7 +50,7 @@ static const int defaultTrackLength = 129;
 struct SliderRange {
     bool isIntegral;
     double minimum;
-    double maximum;
+    double maximum;  // maximum must be >= minimum.
 
     explicit SliderRange(HTMLInputElement*);
     double clampValue(double value);
@@ -80,12 +80,8 @@ SliderRange::SliderRange(HTMLInputElement* element)
 
     isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
 
-    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
-    const AtomicString& maxString = element->getAttribute(maxAttr);
-    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
-
-    // If the maximum is smaller, use it as the minimum.
-    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+    maximum = element->rangeMaximum();
+    minimum = element->rangeMinimum();
 }
 
 double SliderRange::clampValue(double value)
@@ -96,12 +92,14 @@ double SliderRange::clampValue(double value)
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
 {
-    String valueString = element->value();
-    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
     double newValue = clampValue(oldValue);
 
     if (wasClamped)
-        *wasClamped = valueString.isNull() || newValue != oldValue;
+        *wasClamped = !parseSuccess || newValue != oldValue;
 
     return newValue;
 }