Tighten the validation for staying in array buffer bounds BUG=angleproject:1523 Change-Id: I685a9b884e5de73b94900c5b6016ce914b9bfe7f Reviewed-on: https://chromium-review.googlesource.com/418458 Commit-Queue: Corentin Wallez <cwallez@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org>