Limit the size for typed arrays to MaxSmi.

test/mjsunit/regress/regress-319722-ArrayBuffer.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
 //       with the distribution.
 //     * Neither the name of Google Inc. nor the names of its
 //       contributors may be used to endorse or promote products derived
 //       from this software without specific prior written permission.
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-function testPrepareStackTrace(closure) {
-  var error = undefined;
+// Flags: --nostress-opt --allow-natives-syntax
+var maxSize = %MaxSmi() + 1;
+var ab = null;
+
+// Allocate the largest ArrayBuffer we can on this architecture.
+for (k = 8; k >= 1 && ab == null; k = k/2) {

[Jakob Kummerow, 2013/11/15 15:13:08]

the update step should be "k = k >> 1", otherwise "k >= 1" will never become
false and a low memory condition will lead to an endless loop.

[Dmitry Lomov (no reviews), 2013/11/15 16:03:07]

No, I think it is fine as it is, because 1/2 = 0.5 < 1

   try {
-    closure();
-    assertUnreachable();
+    ab = new ArrayBuffer(maxSize * k);
   } catch (e) {
-    error = e;
+    ab = null;
   }
-
-  // We expect custom formatting to be lazy. Setting the custom
-  // function right before calling error.stack should be fine.
-  Error.prepareStackTrace = function(e, frames) {
-    return "bar";
-  }
-
-  assertEquals("bar", error.stack);
-  Error.prepareStackTrace = undefined;
 }
 
-testPrepareStackTrace(function() { throw new Error("foo"); });
-testPrepareStackTrace(function f() { f(); });
+assertTrue(ab != null);
 
+
+function TestArray(constr) {
+  assertThrows(function() {
+    new constr(ab, 0, maxSize);
+  }, RangeError);
+}
+
+TestArray(Uint8Array);
+TestArray(Int8Array);
+TestArray(Uint16Array);
+TestArray(Int16Array);
+TestArray(Uint32Array);
+TestArray(Int32Array);
+TestArray(Float32Array);
+TestArray(Float64Array);
+TestArray(Uint8ClampedArray);
+