Index: src/runtime.cc |
diff --git a/src/runtime.cc b/src/runtime.cc |
index 5b96d1fd464083359c935410293bc96f6bdc4009..c05597a48b6ac05b04773e25e5a9074080fb6592 100644 |
--- a/src/runtime.cc |
+++ b/src/runtime.cc |
@@ -948,12 +948,12 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_TypedArrayInitializeFromArrayLike) { |
Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer(); |
size_t length = NumberToSize(isolate, *length_obj); |
- size_t byte_length = length * element_size; |
- if (byte_length < length) { // Overflow |
+ if (length > (kMaxInt / element_size)) { |
return isolate->Throw(*isolate->factory()-> |
NewRangeError("invalid_array_buffer_length", |
HandleVector<Object>(NULL, 0))); |
} |
+ size_t byte_length = length * element_size; |
// We assume that the caller of this function will initialize holder |
// with the loop |