diff --git a/src/api.cc b/src/api.cc index 4a405a978b..736f0b00d7 100644 --- a/src/api.cc +++ b/src/api.cc @@ -6132,8 +6132,10 @@ i::Handle NewTypedArray( ASSERT(byte_offset % sizeof(ElementType) == 0); + CHECK(length <= (std::numeric_limits::max() / sizeof(ElementType))); + size_t byte_length = length * sizeof(ElementType); SetupArrayBufferView( - isolate, obj, buffer, byte_offset, length * sizeof(ElementType)); + isolate, obj, buffer, byte_offset, byte_length); i::Handle length_object = isolate->factory()->NewNumberFromSize(length);