Range checking bug in typed array constructor.

src/typedarray.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 92 matching lines @@
       if (bufferByteLength % elementSize !== 0) {
         throw MakeRangeError("invalid_typed_array_alignment",
           "byte length", name, elementSize);
       }
       newByteLength = bufferByteLength - offset;
       newLength = newByteLength / elementSize;
     } else {
       var newLength = TO_POSITIVE_INTEGER(length);
       newByteLength = newLength * elementSize;
     }
-    if (newByteLength > bufferByteLength) {
+    if (offset + newByteLength > bufferByteLength) {
       throw MakeRangeError("invalid_typed_array_length");
     }
     %TypedArrayInitialize(obj, arrayId, buffer, offset, newByteLength);
   }
 
   function ConstructByLength(obj, length) {
     var l = IS_UNDEFINED(length) ? 0 : TO_POSITIVE_INTEGER(length);
     var byteLength = l * elementSize;
     var buffer = new $ArrayBuffer(byteLength);
     %TypedArrayInitialize(obj, arrayId, buffer, 0, byteLength);
@@ skipping 86 matching lines @@
 // arrayIds below should be synchronized with Runtime_TypedArrayInitialize.
 SetupTypedArray(1, "Uint8Array", global.Uint8Array, 1);
 SetupTypedArray(2, "Int8Array", global.Int8Array, 1);
 SetupTypedArray(3, "Uint16Array", global.Uint16Array, 2);
 SetupTypedArray(4, "Int16Array", global.Int16Array, 2);
 SetupTypedArray(5, "Uint32Array", global.Uint32Array, 4);
 SetupTypedArray(6, "Int32Array", global.Int32Array, 4);
 SetupTypedArray(7, "Float32Array", global.Float32Array, 4);
 SetupTypedArray(8, "Float64Array", global.Float64Array, 8);
 SetupTypedArray(9, "Uint8ClampedArray", global.Uint8ClampedArray, 1);