[typedarray] Properly initialize JSTypedArray::length with Smi.

test/mjsunit/regress/regress-crbug-650933.js

Index: test/mjsunit/regress/regress-crbug-650933.js
diff --git a/test/message/arrow-invalid-rest-2.js b/test/mjsunit/regress/regress-crbug-650933.js
similarity index 57%
copy from test/message/arrow-invalid-rest-2.js
copy to test/mjsunit/regress/regress-crbug-650933.js
index 3517803d30256b09e78a1aa1f43817e733dc060e..e579f0d0ab11b4c160d2a83f632b53214e35100b 100644
--- a/test/message/arrow-invalid-rest-2.js
+++ b/test/mjsunit/regress/regress-crbug-650933.js
@@ -1,8 +1,8 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-//
 
-var f = (a, ...x = 10) => x;
-f(1, 2, 3, 4, 5);
+var a = [0, 1, 2, 3, 4, 5, 6, 7, 8];
+var o = {length: 1e40};
+try { new Uint8Array(o); } catch (e) { }
+new Float64Array(a);