[typedarray] Really check that the JSTypedArray::length is always a Smi.

src/objects-debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include "src/bootstrapper.h"
 #include "src/disasm.h"
 #include "src/disassembler.h"
 #include "src/field-type.h"
@@ skipping 870 matching lines @@
   VerifyPointer(raw_byte_length());
   CHECK(raw_byte_length()->IsSmi() || raw_byte_length()->IsHeapNumber() ||
         raw_byte_length()->IsUndefined(isolate));
 }
 
 
 void JSTypedArray::JSTypedArrayVerify() {
   CHECK(IsJSTypedArray());
   JSArrayBufferViewVerify();
   VerifyPointer(raw_length());
-  CHECK(raw_length()->IsSmi() || raw_length()->IsHeapNumber() ||
-        raw_length()->IsUndefined(GetIsolate()));
-
+  CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(GetIsolate()));
   VerifyPointer(elements());
 }
 
 
 void JSDataView::JSDataViewVerify() {
   CHECK(IsJSDataView());
   JSArrayBufferViewVerify();
 }
 
 
@@ skipping 460 matching lines @@
 
   // Both are done at the same time.
   CHECK_EQ(new_it.done(), old_it.done());
 }
 
 
 #endif  // DEBUG
 
 }  // namespace internal
 }  // namespace v8