mshtml: Fix buffer underflow in range_to_string. range_to_string scans the buf from right to left for whitespaces. If the buf contains only whitespaces, we will scan past the start of the buf.