When using a vertex buffer with DYNAMIC usage, with robust buffer
access enabled, we would sometimes read out-of-bounds when using very
large values for the index range. An unchecked signed addition would
overflow and lead to reading a negative offset.

Fix this problem by keeping the value size_t whenever possible. Also do
clamped casts when converting to a smaller values.

Also adds a regression test.

Also combined with 26b0bfb46: Fix warnings from size_t conversions.

Bug: chromium:842028
Change-Id: Ie1a8f476f3e97149362eb9855f08450c067ff807
Reviewed-on: https://chromium-review.googlesource.com/1064721Reviewed-by: Jamie Madill <jmadill@chromium.org>