[1.4>master] [MERGE #2350 @atulkatti] Revert the earlier TypedArray change as it may lead to integer overflow.

Merge pull request #2350 from atulkatti:TypedArray.Bug10450472

Author: Atul Katti

lib/Runtime/Library/TypedArray.cpp

@@ -388,7 +388,6 @@ namespace Js
     Var TypedArrayBase::CreateNewInstance(Arguments& args, ScriptContext* scriptContext, uint32 elementSize, PFNCreateTypedArray pfnCreateTypedArray)
     {
         uint32 byteLength = 0;
-        uint32 newByteLength = 0;
         int32 offset = 0;
         int32 mappedLength = -1;
         uint32 elementCount = 0;
@@ -509,16 +508,7 @@ namespace Js
 
             if (args.Info.Count > 3 && !JavascriptOperators::IsUndefinedObject(args[3]))
             {
-                mappedLength = ArrayBuffer::ToIndex(args[3], JSERR_InvalidTypedArrayLength, scriptContext, ArrayBuffer::MaxArrayBufferLength / elementSize, false);
-                newByteLength = mappedLength * elementSize;
-
-                if (offset + newByteLength > byteLength)
-                {
-                    JavascriptError::ThrowRangeError(
-                        scriptContext, JSERR_InvalidTypedArrayLength);
-                }
-
-                byteLength = newByteLength;
+                mappedLength = ArrayBuffer::ToIndex(args[3], JSERR_InvalidTypedArrayLength, scriptContext, (byteLength - offset) / elementSize, false);
             }
             else
             {