Chrome Version: 59 canary
OS: all

Firefox: OK
Safari: NG

What steps will reproduce the problem?
(1) Open http://w3c-test.org/html/semantics/forms/the-input-element/range.html

What is the expected result?
14th test should pass.
"default value when both min and max attributes are given, while min > max"

What happens instead?
14th test fails.

Please use labels and text to provide additional information.
The minimum reproducible URL is:
  data:text/html,<input type="range" min=2 max=-3 /><script>alert(document.querySelector('input').value);</script>

https://html.spec.whatwg.org/multipage/forms.html#concept-input-value-default-range
> The default value is the minimum plus half the difference between the minimum and the maximum, unless the maximum is less than the minimum, in which case the default value is the minimum.

It seems our implementation just ignores the max value in such case.
This is an issue of RangeInputType::sanitizeValue() and StepRange::defaultValue().