[inspector] Don't alloc invalid TypedArrays as previews

ArrayBuffer objects have a larger maximal size than TypedArray objects.
The inspector TypedArray objects to preview ArrayBuffer objects; ensure
we don't exceed the maximal size here.

Bug: chromium:964663,v8:9308
Change-Id: Ia787ff87c799a3f2ca073e36cb54e57e86dacae9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634921
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61917}

src/inspector/value-mirror.cc

@@ -1145,19 +1145,28 @@ void addTypedArrayViews(v8::Local<v8::Context> context,
                         v8::Local<ArrayBuffer> buffer,
                         ValueMirror::PropertyAccumulator* accumulator) {
   // TODO(alph): these should be internal properties.
-  size_t length = buffer->ByteLength();
+  // TODO(v8:9308): Reconsider how large arrays are previewed.
+  const size_t byte_length = buffer->ByteLength();
+
+  size_t length = byte_length;
+  if (length > v8::TypedArray::kMaxLength) return;
+
   addTypedArrayView<v8::Int8Array>(context, buffer, length, "[[Int8Array]]",
                                    accumulator);
   addTypedArrayView<v8::Uint8Array>(context, buffer, length, "[[Uint8Array]]",
                                     accumulator);
-  if (buffer->ByteLength() % 2 == 0) {
-    addTypedArrayView<v8::Int16Array>(context, buffer, length / 2,
-                                      "[[Int16Array]]", accumulator);
-  }
-  if (buffer->ByteLength() % 4 == 0) {
-    addTypedArrayView<v8::Int32Array>(context, buffer, length / 4,
-                                      "[[Int32Array]]", accumulator);
-  }
+
+  length = byte_length / 2;
+  if (length > v8::TypedArray::kMaxLength || (byte_length % 2) != 0) return;
+
+  addTypedArrayView<v8::Int16Array>(context, buffer, length, "[[Int16Array]]",
+                                    accumulator);
+
+  length = byte_length / 4;
+  if (length > v8::TypedArray::kMaxLength || (byte_length % 4) != 0) return;
+
+  addTypedArrayView<v8::Int32Array>(context, buffer, length, "[[Int32Array]]",
+                                    accumulator);
 }
 }  // anonymous namespace