stream: fix decoded fromList chunk boundary check

Correct `fromList()` in decoded string mode to compare `n` against the
current chunk length, not the buffer array length.

This prevents over-consuming chunks, which can corrupt readable state
and crash with `TypeError` when mixing `setEncoding()` and `read(n)`.

Author: watson

lib/internal/streams/readable.js

@@ -1669,7 +1669,7 @@ function fromList(n, state) {
         n -= str.length;
         buf[idx++] = null;
       } else {
-        if (n === buf.length) {
+        if (n === str.length) {
           ret += str;
           buf[idx++] = null;
         } else {

test/parallel/test-stream2-read-correct-num-bytes-in-utf8.js

@@ -0,0 +1,15 @@
+'use strict';
+
+const assert = require('assert');
+const { Readable } = require('stream');
+
+const readable = new Readable({ read() {} });
+readable.setEncoding('utf8');
+
+readable.push('abc');
+readable.push('defgh');
+readable.push(null);
+
+assert.strictEqual(readable.read(5), 'abcde');
+assert.strictEqual(readable.read(3), 'fgh');
+assert.strictEqual(readable.read(1), null);