TypedArray's length is limited to one less element than the actual maximum valid limit (which is UINT32_MAX - BYTES_PER_ELEMENT). If there's a technical reason for this, we should document it more clearly. If there's no technical reason, we should use the actual maximum limit.

Example:

js> var ab = new ArrayBuffer(0x7fff_ffff)
js> var ta = new Int8Array(ab)
typein:2:10 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
Stack:
  @typein:2:10
js> var ta = new Int8Array(ab.slice(1))
js>

js> var ab = new ArrayBuffer(0x7fff_fff8) 
js> var ta = new Float64Array(ab)
typein:2:10 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
Stack:
  @typein:2:10
js> var ta = new Float64Array(ab.slice(8))
js>

I see a bunch of stuff like this but I don't see any code that actually uses INT32_MAX for any special purpose related to TypedArray length or byteLength.

I think we can just change this.

I'm fixing this in bug 1689308 (I started writing the patch, then found this bug).