REGRESSION(r119948): [Forms] Spin button Up/Down actions make value to zero for input type "number" when step mismatched and value is smaller than step

Step Up: <input type=number step=300 value=7>
Step Down: <input type=number step=300 value=-7>

This is caused by following line in InputType::stepUpFromRenderer:

if (sign < 0)
    newValue = base + ((current - base) / step).floor() * step; 
else if (sign > 0)
    newValue = base + ((current - base) / step).ceiling() * step; 

Implementation of Decimal::ceiling and Decimal::floor are wrong.

Created attachment 152177 [details]
Patch 1

Comment on attachment 152177 [details]
Patch 1

Could you review this patch?
Thanks in advance.

[Kent Tamura]

Comment on attachment 152177 [details]
Patch 1

View in context: https://bugs.webkit.org/attachment.cgi?id=152177&action=review

> Source/WebCore/ChangeLog:9
> +        REGRESSION(r119948): [Forms] Spin button Up/Down actions make value to zero for input type "number"
> +        https://bugs.webkit.org/show_bug.cgi?id=91197
> +
> +        Reviewed by NOBODY (OOPS!).
> +
> +        This patch fixes implementation of Decimal::ceiling() and floor().
> +        They return wrong value for small fractional numbers.

Would you explain in what condition this bug occurs in ChangeLog?
It's unclear why Decimal::ceiling() or floor() affects the case with value=7 step=300.

[Kent Tamura]

Please file a Chromium bug to handle a merge to M21 branch.

Created attachment 152184 [details]
Patch 2

Comment on attachment 152184 [details]
Patch 2

Could you review this patch?
Thanks in advance.

= Changes since the last review =
* Add explanation of bug condition to Source/WebCore/ChangeLog
* Update ChangeLog for the bug summary change

[Kent Tamura]

Comment on attachment 152184 [details]
Patch 2

ok

Comment on attachment 152184 [details]
Patch 2

Clearing flags on attachment: 152184

Committed r122552: <http://trac.webkit.org/changeset/122552>

All reviewed patches have been landed.  Closing bug.