Fix some integer issues in StringBuilder.

This pulls in http://trac.webkit.org/changeset/164408 which avoids an
integer overflow / truncation, and fixes another overflow in one of the append()
variants. It's not clear whether there's a path to the failure condition in
Blink.

BUG=345959

Review URL: https://codereview.chromium.org/175703006

git-svn-id: svn://svn.chromium.org/blink/trunk@167634 bbb929c8-8fbe-4397-9dbb-9b2b20218538