Fix TextIterator::subrange wrt replaced elements

In my cl https://codereview.chromium.org/297003003/, i changed TextIterator::rangeLength
to always count replaced elements such as <img>, so that IME could manipulate them. However,
this introduced a regression that spellchecking markers are sometimes misaligned in the
presence of replaced elements. The reason is TextIterator::subrange was not updated accordingly,
that is it ignores replaced elements which are counted in TextIterator::rangeLength.


BUG=417145
TEST=go to http://fiddle.jshell.net/5fo65n8j/2/show/, put cursor at the end of the input box,
the spellchecking marker should be correctly aligned with "testt".

Review URL: https://codereview.chromium.org/611123002

git-svn-id: svn://svn.chromium.org/blink/trunk@183081 bbb929c8-8fbe-4397-9dbb-9b2b20218538