1 files changed, 26 insertions, 38 deletions

diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp b/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
index b514fa0f9..c9812688e 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,13 +27,13 @@
 #include "JSArrayBufferView.h"
 
 #include "JSArrayBuffer.h"
-#include "JSCInlines.h"
+#include "Operations.h"
 #include "Reject.h"
 
 namespace JSC {
 
 const ClassInfo JSArrayBufferView::s_info = {
-    "ArrayBufferView", &Base::s_info, 0, CREATE_METHOD_TABLE(JSArrayBufferView)
+    "ArrayBufferView", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSArrayBufferView)
 };
 
 JSArrayBufferView::ConstructionContext::ConstructionContext(
@@ -78,7 +78,7 @@ JSArrayBufferView::ConstructionContext::ConstructionContext(
             return;
     }
     
-    vm.heap.reportExtraMemoryAllocated(static_cast<size_t>(length) * elementSize);
+    vm.heap.reportExtraMemoryCost(static_cast<size_t>(length) * elementSize);
     
     m_structure = structure;
     m_mode = OversizeTypedArray;
@@ -88,10 +88,10 @@ JSArrayBufferView::ConstructionContext::ConstructionContext(
     VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
     unsigned byteOffset, unsigned length)
     : m_structure(structure)
+    , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset)
     , m_length(length)
     , m_mode(WastefulTypedArray)
 {
-    m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
     IndexingHeader indexingHeader;
     indexingHeader.setArrayBuffer(arrayBuffer.get());
     m_butterfly = Butterfly::create(vm, 0, 0, 0, true, indexingHeader, 0);
@@ -101,19 +101,19 @@ JSArrayBufferView::ConstructionContext::ConstructionContext(
     Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
     unsigned byteOffset, unsigned length, DataViewTag)
     : m_structure(structure)
+    , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset)
     , m_length(length)
     , m_mode(DataViewMode)
     , m_butterfly(0)
 {
-    m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
 }
 
 JSArrayBufferView::JSArrayBufferView(VM& vm, ConstructionContext& context)
     : Base(vm, context.structure(), context.butterfly())
+    , m_vector(context.vector())
     , m_length(context.length())
     , m_mode(context.mode())
 {
-    m_vector.setWithoutBarrier(static_cast<char*>(context.vector()));
 }
 
 void JSArrayBufferView::finishCreation(VM& vm)
@@ -140,6 +140,10 @@ bool JSArrayBufferView::getOwnPropertySlot(
     JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(object);
+    if (propertyName == exec->propertyNames().byteOffset) {
+        slot.setValue(thisObject, DontDelete | ReadOnly, jsNumber(thisObject->byteOffset()));
+        return true;
+    }
     
     if (propertyName == exec->propertyNames().buffer) {
         slot.setValue(
@@ -156,7 +160,9 @@ void JSArrayBufferView::put(
     PutPropertySlot& slot)
 {
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(cell);
-    if (propertyName == exec->propertyNames().buffer) {
+    if (propertyName == exec->propertyNames().byteLength
+        || propertyName == exec->propertyNames().byteOffset
+        || propertyName == exec->propertyNames().buffer) {
         reject(exec, slot.isStrictMode(), "Attempting to write to read-only typed array property.");
         return;
     }
@@ -169,7 +175,9 @@ bool JSArrayBufferView::defineOwnProperty(
     const PropertyDescriptor& descriptor, bool shouldThrow)
 {
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(object);
-    if (propertyName == exec->propertyNames().buffer)
+    if (propertyName == exec->propertyNames().byteLength
+        || propertyName == exec->propertyNames().byteOffset
+        || propertyName == exec->propertyNames().buffer)
         return reject(exec, shouldThrow, "Attempting to define read-only typed array property.");
     
     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
@@ -179,7 +187,9 @@ bool JSArrayBufferView::deleteProperty(
     JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(cell);
-    if (propertyName == exec->propertyNames().buffer)
+    if (propertyName == exec->propertyNames().byteLength
+        || propertyName == exec->propertyNames().byteOffset
+        || propertyName == exec->propertyNames().buffer)
         return false;
     
     return Base::deleteProperty(thisObject, exec, propertyName);
@@ -190,9 +200,12 @@ void JSArrayBufferView::getOwnNonIndexPropertyNames(
 {
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(object);
     
-    if (mode.includeDontEnumProperties())
+    // length/byteOffset/byteLength are DontEnum, at least in Firefox.
+    if (mode == IncludeDontEnumProperties) {
+        array.add(exec->propertyNames().byteOffset);
+        array.add(exec->propertyNames().byteLength);
         array.add(exec->propertyNames().buffer);
-
+    }
     
     Base::getOwnNonIndexPropertyNames(thisObject, exec, array, mode);
 }
@@ -202,33 +215,8 @@ void JSArrayBufferView::finalize(JSCell* cell)
     JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
     ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
     if (thisObject->m_mode == OversizeTypedArray)
-        fastFree(thisObject->m_vector.getWithoutBarrier());
+        fastFree(thisObject->m_vector);
 }
 
 } // namespace JSC
 
-namespace WTF {
-
-using namespace JSC;
-
-void printInternal(PrintStream& out, TypedArrayMode mode)
-{
-    switch (mode) {
-    case FastTypedArray:
-        out.print("FastTypedArray");
-        return;
-    case OversizeTypedArray:
-        out.print("OversizeTypedArray");
-        return;
-    case WastefulTypedArray:
-        out.print("WastefulTypedArray");
-        return;
-    case DataViewMode:
-        out.print("DataViewMode");
-        return;
-    }
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-