Range checking bug in typed array constructor.

test/mjsunit/harmony/typedarrays.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 174 matching lines @@
 
   for (i = 0; i < 128; i++) {
     assertSame(0, a4[i]);
   }
 
   for (i = 128; i < 256; i++) {
     assertSame(typicalElement, a4[i]);
   }
 
   assertThrows(function () { new proto(ab, 256*elementSize); }, RangeError);
+  assertThrows(
+      function () { new proto(ab, 128*elementSize, 192); },
+      RangeError);
 
   if (elementSize !== 1) {
     assertThrows(function() { new proto(ab, 128*elementSize - 1, 10); },
                  RangeError);
     var unalignedArrayBuffer = new ArrayBuffer(10*elementSize + 1);
     var goodArray = new proto(unalignedArrayBuffer, 0, 10);
     assertSame(10, goodArray.length);
     assertSame(10*elementSize, goodArray.byteLength);
     assertThrows(function() { new proto(unalignedArrayBuffer)}, RangeError);
     assertThrows(function() { new proto(unalignedArrayBuffer, 5*elementSize)},
@@ skipping 87 matching lines @@
   }
   for (var i = 0; i < 20; i++) {
     TestProperty(m, i, 'val' + i);
     TestProperty(m, 'foo' + i, 'bar' + i);
   }
 }
 TestArbitrary(new ArrayBuffer(256));
 
 // Test direct constructor call
 assertTrue(ArrayBuffer() instanceof ArrayBuffer);