http://trac.webkit.org/changeset/13156 added BeforeTextInsertedEvent, which is used to implement maxlength in input element. However, this event is also exposed to JavaScript. In order to make editing code safer, it's beneficial to remove this event entirely or at least make it invisible from JavaScript. This event is fired by ReplacementFragment and TypingCommand::insertText
It seems like this is not or no longer exposed to JavaScript. At least http://software.hixie.ch/utilities/js/live-dom-viewer/?%3Cscript%3E%0Aw(self.BeforeTextInsertedEvent)%0A%3C%2Fscript%3E logs undefined.
We still fire this event in ReplacementFragment::ReplacementFragment.