REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value

REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value
https://bugs.webkit.org/show_bug.cgi?id=91587

Reviewed by Benjamin Poulain.

Source/WebCore:

The bug was caused by my douchey code that set the length cache to be the *offset*
of the last item in a HTMLCollection. Clearly, the length of a collection that contains
the last item at offset n is n + 1. Fixed that.

Also removed the call to setLengthCache in HTMLCollection::length since it must have set
by previous calls to itemBeforeOrAfterCachedItem already. This will allow us to catch
regressions like this in ports that use JSC bindings as well.

Test: fast/dom/htmlcollection-length-after-item.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::length):
(WebCore::HTMLCollection::itemBeforeOrAfterCachedItem):

LayoutTests:

Add a regression test. It only fails on Chromium port before the patch is applied because JSC binding code
has a bug (?) that it always checks index > length() to throw an exception before accessing an item in HTMLCollection.

* fast/dom/htmlcollection-length-after-item-expected.txt: Added.
* fast/dom/htmlcollection-length-after-item.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122930 268f45cc-cd09-0410-ab3c-d52691b4dbfc