Integer overflow in method_set of TypedArray

ReturnedValue IntrinsicTypedArrayPrototype::method_set(const FunctionObject *b, const Value *thisObject, const Value *argv, int argc)
{
    ...
 
    Scoped<TypedArray> srcTypedArray(scope, argv[0]);
    if (!srcTypedArray) {
        ...
        double len = ScopedValue(scope, o->get(scope.engine->id_length()))->toNumber();
        uint l = (uint)len;
        ...
        if (offset + l > a->length())
            RETURN_RESULT(scope.engine->throwRangeError(QStringLiteral("TypedArray.set: out of range")));
        ...
        while (idx < l) {
            val = o->get(idx);
            ...
            val = val->convertedToNumber();
            ...
            a->d()->type->write(b, val);
            ...
            ++idx;
            b += elementSize;
        }
        RETURN_UNDEFINED();
    }
 
    ...
}