reflect: panic if MakeSlice is given bad len/cap arguments.

Fixes #3330.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/5847043

src/pkg/reflect/value.go

@@ -1632,6 +1632,15 @@ func MakeSlice(typ Type, len, cap int) Value {
 	if typ.Kind() != Slice {
 		panic("reflect.MakeSlice of non-slice type")
 	}
+	if len < 0 {
+		panic("reflect.MakeSlice: negative len")
+	}
+	if cap < 0 {
+		panic("reflect.MakeSlice: negative cap")
+	}
+	if len > cap {
+		panic("reflect.MakeSlice: len > cap")
+	}
 
 	// Declare slice so that gc can see the base pointer in it.
 	var x []byte