Runtime CHECK for overflow in NewTypedArray.

src/api.cc

Index: src/api.cc
diff --git a/src/api.cc b/src/api.cc
index 4a405a978b3d80fb7e8f1f6a9e338cfb740e4298..736f0b00d7ac833ca3409ebd703a90f8ef49a5bc 100644
--- a/src/api.cc
+++ b/src/api.cc
@@ -6132,8 +6132,10 @@ i::Handle<i::JSTypedArray> NewTypedArray(
 
   ASSERT(byte_offset % sizeof(ElementType) == 0);
 
+  CHECK(length <= (std::numeric_limits<size_t>::max() / sizeof(ElementType)));
+  size_t byte_length = length * sizeof(ElementType);
   SetupArrayBufferView(
-      isolate, obj, buffer, byte_offset, length * sizeof(ElementType));
+      isolate, obj, buffer, byte_offset, byte_length);
 
   i::Handle<i::Object> length_object =
     isolate->factory()->NewNumberFromSize(length);