Specify a limit in HTMLOptionsCollection.length setter.

This aligns with WebKit's behavior as per the discussion in
#8337.

source

@@ -8413,8 +8413,9 @@ interface <dfn interface>HTMLOptionsCollection</dfn> : <span>HTMLCollection</spa
     <p>When set to a smaller number than the existing length, truncates the number of
     <code>option</code> elements in the container corresponding to <var>collection</var>.</p>
 
-    <p>When set to a greater number than the existing length, adds new blank <code>option</code>
-    elements to the container corresponding to <var>collection</var>.</p>
+    <p>When set to a greater number than the existing length, if that number is less than or equal
+    to 10000, adds new blank <code>option</code> elements to the container corresponding to
+    <var>collection</var>.</p>
    </dd>
 
    <dt><code data-x=""><var>element</var> = <var>collection</var>.<span data-x="dom-HTMLCollection-item">item</span>(<var>index</var>)</code></dt>
@@ -8478,13 +8479,37 @@ interface <dfn interface>HTMLOptionsCollection</dfn> : <span>HTMLCollection</spa
   data-x="dom-HTMLOptionsCollection-length">length</code></dfn> attribute must return the number of
   nodes <span>represented by the collection</span>.</p>
 
-  <p>On setting, the behavior depends on whether the new value is equal to, greater than, or less
-  than the number of nodes <span>represented by the collection</span> at that time. If the number is
-  the same, then setting the attribute must do nothing. If the new value is greater, then <var>n</var> new <code>option</code> elements with no attributes and no child nodes must be
-  appended to the <code>select</code> element on which the <code>HTMLOptionsCollection</code> is
-  rooted, where <var>n</var> is the difference between the two numbers (new value minus old
-  value). Mutation events must be fired as if a <code>DocumentFragment</code> containing the new
-  <code>option</code> elements had been inserted. If the new value is lower, then the last <var>n</var> nodes in the collection must be removed from their parent nodes, where <var>n</var> is the difference between the two numbers (old value minus new value).</p>
+  <p>On setting to a new value <var>value</var>, the user agent must run the following algorithm:</p>
+
+  <ol>
+   <li><p>Let <var>current</var> be the number of nodes <span>represented by the
+   collection</span>.</p></li>
+
+   <li>
+    <p>If <var>value</var> is greater than <var>current</var>, then:</p>
+
+    <ol>
+     <li><p>If <var>value</var> is greater than 10000, then abort these steps.</p></li>
+
+     <li><p>Let <var>n</var> be <var>value</var> - <var>current</var>.</p></li>
+
+     <li><p>Append <var>n</var> new <code>option</code> elements with no attributes and no child
+     nodes to the <code>select</code> element on which the <code>HTMLOptionsCollection</code> is
+     rooted. Mutation events must be fired as if a <code>DocumentFragment</code> containing the new
+     <code>option</code> elements had been inserted.</p></li>
+    </ol>
+   </li>
+
+   <li>
+    <p>If <var>value</var> is less than <var>current</var>, then:</p>
+
+    <ol>
+     <li><p>Let <var>n</var> be <var>current</var> - <var>value</var>.</p></li>
+
+     <li><p>Remove the last <var>n</var> nodes in the collection from their parent nodes.</p></li>
+    </ol>
+   </li>
+  </ol>
 
   <p class="note">Setting <code data-x="dom-HTMLOptionsCollection-length">length</code> never removes
   or adds any <code>optgroup</code> elements, and never adds new children to existing