Add CharacterData.deleteData()/replaceData() overflow handling.

      If the offset and count exceed the underlying length, the spec tells us

  http://dom.spec.whatwg.org/#concept-cd-replace (step 3)

to use a count that is equal to length minus the offset. Perform that
check in an overflow-sensitive manner.

(Change based on https://codereview.chromium.org/188693007/ )

R=
BUG=349898

Review URL: https://codereview.chromium.org/229793004

git-svn-id: svn://svn.chromium.org/blink/trunk@171165 bbb929c8-8fbe-4397-9dbb-9b2b20218538