Specify a limit for HTMLOptionsCollection's length setter

This aligns with WebKit's behavior, but bumps the limit to 100k from WebKit's 10k, as per the discussion in #8337.

Closes #8337.

source

@@ -8374,8 +8374,9 @@ interface <dfn interface>HTMLOptionsCollection</dfn> : <span>HTMLCollection</spa
     <p>When set to a smaller number than the existing length, truncates the number of
     <code>option</code> elements in the container corresponding to <var>collection</var>.</p>
 
-    <p>When set to a greater number than the existing length, adds new blank <code>option</code>
-    elements to the container corresponding to <var>collection</var>.</p>
+    <p>When set to a greater number than the existing length, if that number is less than or equal
+    to 100000, adds new blank <code>option</code> elements to the container corresponding to
+    <var>collection</var>.</p>
    </dd>
 
    <dt><code data-x=""><var>element</var> = <var>collection</var>.<span data-x="dom-HTMLCollection-item">item</span>(<var>index</var>)</code></dt>
@@ -8435,17 +8436,41 @@ interface <dfn interface>HTMLOptionsCollection</dfn> : <span>HTMLCollection</spa
   <p>The object's <span>supported property indices</span> are as defined for
   <code>HTMLCollection</code> objects.</p>
 
-  <p>On getting, the <dfn attribute for="HTMLOptionsCollection"><code
-  data-x="dom-HTMLOptionsCollection-length">length</code></dfn> attribute must return the number of
-  nodes <span>represented by the collection</span>.</p>
-
-  <p>On setting, the behavior depends on whether the new value is equal to, greater than, or less
-  than the number of nodes <span>represented by the collection</span> at that time. If the number is
-  the same, then setting the attribute must do nothing. If the new value is greater, then <var>n</var> new <code>option</code> elements with no attributes and no child nodes must be
-  appended to the <code>select</code> element on which the <code>HTMLOptionsCollection</code> is
-  rooted, where <var>n</var> is the difference between the two numbers (new value minus old
-  value). Mutation events must be fired as if a <code>DocumentFragment</code> containing the new
-  <code>option</code> elements had been inserted. If the new value is lower, then the last <var>n</var> nodes in the collection must be removed from their parent nodes, where <var>n</var> is the difference between the two numbers (old value minus new value).</p>
+  <p>The <dfn attribute for="HTMLOptionsCollection"><code
+  data-x="dom-HTMLOptionsCollection-length">length</code></dfn> getter steps are to return the
+  number of nodes <span>represented by the collection</span>.</p>
+
+  <p>The <code data-x="dom-HTMLOptionsCollection-length">length</code> setter steps are:</p>
+
+  <ol>
+   <li><p>Let <var>current</var> be the number of nodes <span>represented by the
+   collection</span>.</p></li>
+
+   <li>
+    <p>If the given value is greater than <var>current</var>, then:</p>
+
+    <ol>
+     <li><p>If the given value is greater than 100,000, then return.</p></li>
+
+     <li><p>Let <var>n</var> be <var>value</var> &minus; <var>current</var>.</p></li>
+
+     <li><p>Append <var>n</var> new <code>option</code> elements with no attributes and no child
+     nodes to the <code>select</code> element on which <span>this</span> is rooted. Mutation events
+     must be fired as if a <code>DocumentFragment</code> containing the new <code>option</code>
+     elements had been inserted.</p></li>
+    </ol>
+   </li>
+
+   <li>
+    <p>If the given value is less than <var>current</var>, then:</p>
+
+    <ol>
+     <li><p>Let <var>n</var> be <var>current</var> &minus; <var>value</var>.</p></li>
+
+     <li><p>Remove the last <var>n</var> nodes in the collection from their parent nodes.</p></li>
+    </ol>
+   </li>
+  </ol>
 
   <p class="note">Setting <code data-x="dom-HTMLOptionsCollection-length">length</code> never removes
   or adds any <code>optgroup</code> elements, and never adds new children to existing