buffer: fix assert fail from JS API

Length arguments passed to SlowBuffer were coerced to Int32, not Uint32,
so passing a negative number would throw the following:

node: ../src/smalloc.cc:244: void node::smalloc::Alloc(): Assertion `length <= kMaxLength' failed.
Aborted (core dumped)

That has been fixed by coercing to Uint32 and comparing the value
against kMaxLength.

lib/buffer.js

@@ -89,7 +89,9 @@ function Buffer(subject, encoding) {
 
 
 function SlowBuffer(length) {
-  length = ~~length;
+  length = length >>> 0;
+  if (length > kMaxLength)
+    throw new RangeError('length > kMaxLength');
   var b = new NativeBuffer(length);
   alloc(b, length);
   return b;