Limit the size for typed arrays to MaxSmi.

src/typedarray.js

Index: src/typedarray.js
diff --git a/src/typedarray.js b/src/typedarray.js
index 422dc4a03cba36b8a422b5913babaafe1c83bb06..7cb9885cd57b43087b4db3b727f8418d4162f1db 100644
--- a/src/typedarray.js
+++ b/src/typedarray.js
@@ -87,6 +87,8 @@ macro TYPED_ARRAY_CONSTRUCTOR(ARRAY_ID, NAME, ELEMENT_SIZE)
   function NAMEConstructByLength(obj, length) {
     var l = IS_UNDEFINED(length) ?
       0 : ToPositiveInteger(length, "invalid_typed_array_length");
+    if (l > %MaxSmi())
+      throw MakeRangeError(length, "invalid_typed_array_length");

[Jakob Kummerow, 2013/11/15 15:13:08]

nit: {} please

[Dmitry Lomov (no reviews), 2013/11/15 16:03:07]

Done.

     var byteLength = l * ELEMENT_SIZE;
     var buffer = new $ArrayBuffer(byteLength);
     %TypedArrayInitialize(obj, ARRAY_ID, buffer, 0, byteLength);