inset and inset-rectangle trigger assert with iframe and large percentage width

A bounds check was omitted when computing the width and height for inset
rectangles, making it possible for the width or height to end up being
negative. This patch adds in that check for both.

BUG=344359

Review URL: https://codereview.chromium.org/163803003

git-svn-id: svn://svn.chromium.org/blink/trunk@167481 bbb929c8-8fbe-4397-9dbb-9b2b20218538