[typedarray] Properly initialize JSTypedArray::length with Smi.

src/runtime/runtime-typedarray.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/factory.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
@@ skipping 182 matching lines @@
   ElementsKind fixed_elements_kind = INT8_ELEMENTS;  // Bogus initialization.
   Runtime::ArrayIdToTypeAndSize(arrayId, &array_type, &fixed_elements_kind,
                                 &element_size);
 
   CHECK(holder->map()->elements_kind() == fixed_elements_kind);
 
   Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
   size_t length = 0;
   if (source->IsJSTypedArray() &&
       JSTypedArray::cast(*source)->type() == array_type) {
-    length_obj = handle(JSTypedArray::cast(*source)->length(), isolate);
     length = JSTypedArray::cast(*source)->length_value();
   } else {
     CHECK(TryNumberToSize(*length_obj, &length));
-    CHECK(length_obj->IsSmi());
   }
 
   if ((length > static_cast<unsigned>(Smi::kMaxValue)) ||
       (length > (kMaxInt / element_size))) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewRangeError(MessageTemplate::kInvalidTypedArrayLength));
   }
   size_t byte_length = length * element_size;
 
   DCHECK_EQ(v8::ArrayBufferView::kInternalFieldCount,
@@ skipping 22 matching lines @@
                                           false)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
   }
 
   holder->set_buffer(*buffer);
   holder->set_byte_offset(Smi::FromInt(0));
   Handle<Object> byte_length_obj(
       isolate->factory()->NewNumberFromSize(byte_length));
   holder->set_byte_length(*byte_length_obj);
+  length_obj = isolate->factory()->NewNumberFromSize(length);
   holder->set_length(*length_obj);
 
   Handle<FixedTypedArrayBase> elements =
       isolate->factory()->NewFixedTypedArrayWithExternalPointer(
           static_cast<int>(length), array_type,
           static_cast<uint8_t*>(buffer->backing_store()));
   holder->set_elements(*elements);
 
   if (source->IsJSTypedArray()) {
     Handle<JSTypedArray> typed_array(JSTypedArray::cast(*source));
@@ skipping 155 matching lines @@
     return isolate->heap()->false_value();
   }
 
   Handle<JSTypedArray> obj(JSTypedArray::cast(args[0]));
   return isolate->heap()->ToBoolean(obj->GetBuffer()->is_shared() &&
                                     obj->type() == kExternalInt32Array);
 }
 
 }  // namespace internal
 }  // namespace v8