The better USRL is this one - http://output.jsbin.com/jepexaveri
I can confirm it happens on chromebook, and not with Chrome on Linux. And some characters can be added, but some not.

Not sure what is the user impact though.

The way this works for IME is that we allow a composition to go past the maxlength value, but then truncate once the composition is closed. The reason for this is that e.g. when typing Chinese, the pinyin you have to type on the keyboard is a lot longer than the actual text that gets entered.

Perhaps there's an argument that when you're already at the limit of the text box, we shouldn't even let you open a composition. I think this is a minor issue at most though.

IMO this issue should be by design.

Revising the issue title to generalize the issue.

But I am not sure whether the Element.value should exclude the composition text.

Mark WontFix since this is expected behavior.

>#c6, "maxlength" and other control value restrictions are applied after composition committed.