Fixed crash when StringView is created with a length and an offset

BUG=

When StringView is created with a length and an offset, the passed impl
StringImpl is used to check that the length doesn't surpass the StringImpl's
length.
The passed impl variable is a PassRefPtr, that is assigned earlier to m_impl.
Therefore, by the time timpl->length() was called, impl was often already deleted.
That resulted in a crash when creating a StringView that way.

I fixed it by changing the impl->length() call to m_impl->length().

Review URL: https://chromiumcodereview.appspot.com/23691070

git-svn-id: svn://svn.chromium.org/blink/trunk@157919 bbb929c8-8fbe-4397-9dbb-9b2b20218538