Always emits an object replacement char when computing a range

This is a followup of my previous CL https://codereview.chromium.org/297003003/ that emits an object replacement char in InputMethodController::setSelectionOffsets. The previous CL was intended to fix the issue 311448 that an image element cannot be easily deleted with android keyboard. Unfortunately the previous CL did not fix the issue 311448 completely, and introduced regressions.

The reason is that Chrome only emits object replacement chars for replaced elements in InputMethodController::setSelectionOffsets, and ignores replaced elements in all other cases, thus

1. IME still does not see the image element, thus (in most cases) Chrome still can not delete an image element. Try the test case at http://jsfiddle.net/CuDUL/2/ with android default english keyboard on canary, put the caret after the image and press 'Backspace', you will see Chrome move the caret before the image instead of deleting the image.

2. Chrome internally has inconsistent knowledge about plain text offsets when the input contains replaced elements. InputMethodController::setSelectionOffsets assumes the input plain text offsets include replaced elements, while everywhere else plain text offsets exclude replaced elements, thus the offsets are often incorrectly used. Try http://jsfiddle.net/CuDUL/7/, put the cursor at the end of 'hello', you will see Chrome automatically move the caret left by 1.

To fix the issue, Chrome should always emit an object replacement char when computing a range or plainTextRange.

BUG=311448

Review URL: https://codereview.chromium.org/368423002

git-svn-id: svn://svn.chromium.org/blink/trunk@177903 bbb929c8-8fbe-4397-9dbb-9b2b20218538