Add a check to prevent len from going negative in xmlParseAttValueComplex.

BUG=158249


Review URL: https://chromiumcodereview.appspot.com/11343029

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@164867 0039d316-1c4b-4281-b951-d872f2087c98