Update max offset in SimplifiedBackwardsTextIterator when iterating over first-letter renderers

When iterating over first-letter renderers with SimplifiedBackwardsTextIterator,
the m_offset (which is updated in ::advance to point to the maximum offset
in the current renderer) isn't updated to account for the difference in length
between the first-letter renderer and the RenderText. Thankfully, reading past
the end of the content was guarded by a release assert, so this just prevents
a renderer crash.

BUG=328446

Review URL: https://codereview.chromium.org/93603005

git-svn-id: svn://svn.chromium.org/blink/trunk@164446 bbb929c8-8fbe-4397-9dbb-9b2b20218538