REGRESSION: Text input value is truncated unexpectedly.

This is a regression by Blink r155803.

If new text input value ended with a leading surrogate character, and the
following memory area had a control character, the surrogate character was
unexpectedly removed.

We should not read memory outside of the input string in limitLength().

BUG=285997
TEST=automated.

Review URL: https://chromiumcodereview.appspot.com/23526022

git-svn-id: svn://svn.chromium.org/blink/trunk@157334 bbb929c8-8fbe-4397-9dbb-9b2b20218538