Problem

The TypeScript ByteBuffer read accessors index the underlying typed array without any bounds validation, and every offset comes from the buffer itself when reading untrusted data (network, files):

• an out-of-range offset reads undefined, which NaN-propagates through later offset arithmetic instead of failing,
• a negative offset wraps around the typed array (bytes[-1] → undefined, and computed indices can land anywhere) with no error,
• __string with a length running past the end silently returns a truncated string (subarray clamps), and a length of 0xffffffff behaves the same way,
• __vector returns a start position beyond the buffer without complaint; element reads then produce undefined.

Change

• Adds a private checkRead_(offset, size) guard wired into readUint8/readUint16/readInt32 (the remaining reads and __offset/__indirect/__vector_len/__union all flow through these),
• __string validates the final offset + length range and rejects huge unsigned lengths,
• __vector validates the computed start (an empty vector may start exactly at the end).

Out-of-bounds reads now throw RangeError with a clear message. This mirrors the read-bounds enforcement direction the Swift port has adopted (#9277), applied to the TS port.

Test plan

• New tests/ts/JavaScriptByteBufferBoundsTest.js (registered in TypeScriptTest.py): OOB/negative scalar reads, oversized and negative-length strings, vector start past the end, plus in-bounds and valid-data sanity cases — all pass
• On master, the same test fails (AssertionError: Missing expected exception) — confirming the previously silent reads
• Existing suites unchanged: JavaScriptTest, JavaScriptFlexBuffersTest, JavaScriptUnionVectorTest, JavaScriptComplexArraysTest, JavaScriptUnionUnderlyingTypeTest, JavaScriptUndefinedForOptionals all pass after the change (no false positives on valid buffers)
• tsc compile clean