Newline characters in pasted text are not counted correctly for textarea[maxlength].

third_party/WebKit/Source/core/html/HTMLTextAreaElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 315 matching lines @@
         selectionLength = computeLengthForSubmission(document().frame()->selection().selectedText());
     }
     ASSERT(currentLength >= selectionLength);
     unsigned baseLength = currentLength - selectionLength;
     unsigned appendableLength = unsignedMaxLength > baseLength ? unsignedMaxLength - baseLength : 0;
     event->setText(sanitizeUserInputValue(event->text(), appendableLength));
 }
 
 String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue, unsigned maxLength)
 {
-    if (maxLength > 0 && U16_IS_LEAD(proposedValue[maxLength - 1]))
-        --maxLength;
-    return proposedValue.left(maxLength);
+    unsigned submissionLength = 0;
+    unsigned i = 0;
+    for (; i < proposedValue.length(); ++i) {
+        submissionLength += proposedValue[i] == '\n' ? 2 : 1;
+        if (submissionLength == maxLength) {
+            ++i;
+            break;
+        }
+        if (submissionLength > maxLength)
+            break;
+    }
+    if (i > 0 && U16_IS_LEAD(proposedValue[i - 1]))
+        --i;
+    return proposedValue.left(i);
 }
 
 void HTMLTextAreaElement::updateValue() const
 {
     if (m_valueIsUpToDate)
         return;
 
     m_value = innerEditorValue();
     const_cast<HTMLTextAreaElement*>(this)->m_valueIsUpToDate = true;
     const_cast<HTMLTextAreaElement*>(this)->notifyFormStateChanged();
@@ skipping 313 matching lines @@
 
 void HTMLTextAreaElement::copyNonAttributePropertiesFromElement(const Element& source)
 {
     const HTMLTextAreaElement& sourceElement = static_cast<const HTMLTextAreaElement&>(source);
     setValueCommon(sourceElement.value(), DispatchNoEvent, SetSeletion);
     m_isDirty = sourceElement.m_isDirty;
     HTMLTextFormControlElement::copyNonAttributePropertiesFromElement(source);
 }
 
 } // namespace blink