OOB read in harfbuzz with khmer character.

      Sets face->tmpLogClusters[i] to the last valid value of |item->log_clusters|
when |i| exceeds the size of the |item->log_clusters|.

BUG=90134
TEST=checked with ASAN and ran webkit/tools/layout_tests/run_webkit_tests.sh


Review URL: http://codereview.chromium.org/7465036

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@94616 0039d316-1c4b-4281-b951-d872f2087c98