[typedarray] Really check that the JSTypedArray::length is always a Smi.

src/runtime/runtime-typedarray.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/factory.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
@@ skipping 186 matching lines @@
   CHECK(holder->map()->elements_kind() == fixed_elements_kind);
 
   Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
   size_t length = 0;
   if (source->IsJSTypedArray() &&
       JSTypedArray::cast(*source)->type() == array_type) {
     length_obj = handle(JSTypedArray::cast(*source)->length(), isolate);
     length = JSTypedArray::cast(*source)->length_value();
   } else {
     CHECK(TryNumberToSize(*length_obj, &length));
+    CHECK(length_obj->IsSmi());
   }
 
   if ((length > static_cast<unsigned>(Smi::kMaxValue)) ||
       (length > (kMaxInt / element_size))) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewRangeError(MessageTemplate::kInvalidTypedArrayLength));
   }
   size_t byte_length = length * element_size;
 
   DCHECK_EQ(v8::ArrayBufferView::kInternalFieldCount,
@@ skipping 197 matching lines @@
     return isolate->heap()->false_value();
   }
 
   Handle<JSTypedArray> obj(JSTypedArray::cast(args[0]));
   return isolate->heap()->ToBoolean(obj->GetBuffer()->is_shared() &&
                                     obj->type() == kExternalInt32Array);
 }
 
 }  // namespace internal
 }  // namespace v8