Check the offset argument of TypedArray.set for fitting into Smi.

test/mjsunit/regress/regress-340125.js

Index: test/mjsunit/regress/regress-340125.js
diff --git a/test/mjsunit/regress/regress-336820.js b/test/mjsunit/regress/regress-340125.js
similarity index 89%
copy from test/mjsunit/regress/regress-336820.js
copy to test/mjsunit/regress/regress-340125.js
index 9b466296043b858df75b7f1fe9f959b66abea969..a3e40a8d5ac4cc381dd70f83e32914ddbbc972f1 100644
--- a/test/mjsunit/regress/regress-336820.js
+++ b/test/mjsunit/regress/regress-340125.js
@@ -24,13 +24,7 @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-assertThrows((function() {
-  s = "Hello World!\n";
-  while (true) {
-    x = new Array();
-    x[0] = s;
-    x[1000] = s;
-    x[1000000] = s;
-    s = x.join("::");
-  }}), RangeError);
+//
+var a = new Int8Array(2);
+var b = a.subarray(2, 4);
+assertThrows(function () { a.set(b, 1e10); }, RangeError);