| Index: src/typedarray.js
|
| diff --git a/src/typedarray.js b/src/typedarray.js
|
| index fc3a608f46ff83afd30b4b1108ac1f24e2419602..ed9de23b50e1a6a4b7b3cb06948ac24cf4881d0b 100644
|
| --- a/src/typedarray.js
|
| +++ b/src/typedarray.js
|
| @@ -78,7 +78,8 @@ macro TYPED_ARRAY_CONSTRUCTOR(ARRAY_ID, NAME, ELEMENT_SIZE)
|
| var newLength = ToPositiveInteger(length, "invalid_typed_array_length");
|
| newByteLength = newLength * ELEMENT_SIZE;
|
| }
|
| - if (offset + newByteLength > bufferByteLength) {
|
| + if ((offset + newByteLength > bufferByteLength)
|
| + || (newLength > %MaxSmi())) {
|
| throw MakeRangeError("invalid_typed_array_length");
|
| }
|
| %TypedArrayInitialize(obj, ARRAY_ID, buffer, offset, newByteLength);
|
|
|