1 files changed, 35 insertions, 20 deletions

diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.h b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
index 3feb03b72..447c83a3e 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,13 +23,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSArrayBufferView_h
-#define JSArrayBufferView_h
+#pragma once
 
+#include "AuxiliaryBarrier.h"
 #include "JSObject.h"
 
 namespace JSC {
 
+class LLIntOffsetsExtractor;
+
 // This class serves two purposes:
 //
 // 1) It provides those parts of JSGenericTypedArrayView that don't depend
@@ -51,7 +53,7 @@ namespace JSC {
 // Typed array views have different modes depending on how big they are and
 // whether the user has done anything that requires a separate backing
 // buffer or the DOM-specified neutering capabilities.
-enum TypedArrayMode {
+enum TypedArrayMode : uint32_t {
     // Small and fast typed array. B is unused, V points to a vector
     // allocated in copied space, and M = FastTypedArray. V's liveness is
     // determined entirely by the view's liveness.
@@ -93,7 +95,6 @@ inline bool hasArrayBuffer(TypedArrayMode mode)
 class JSArrayBufferView : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    
     static const unsigned fastSizeLimit = 1000;
     
     static size_t sizeOf(uint32_t length, uint32_t elementSize)
@@ -117,13 +118,16 @@ protected:
         
         JS_EXPORT_PRIVATE ConstructionContext(VM&, Structure*, uint32_t length, uint32_t elementSize, InitializationMode = ZeroFill);
         
+        // This is only for constructing fast typed arrays. It's used by the JIT's slow path.
+        ConstructionContext(Structure*, uint32_t length, void* vector);
+        
         JS_EXPORT_PRIVATE ConstructionContext(
-            VM&, Structure*, PassRefPtr<ArrayBuffer>,
+            VM&, Structure*, RefPtr<ArrayBuffer>&&,
             unsigned byteOffset, unsigned length);
         
         enum DataViewTag { DataView };
         ConstructionContext(
-            Structure*, PassRefPtr<ArrayBuffer>,
+            Structure*, RefPtr<ArrayBuffer>&&,
             unsigned byteOffset, unsigned length, DataViewTag);
         
         bool operator!() const { return !m_structure; }
@@ -145,22 +149,26 @@ protected:
     JS_EXPORT_PRIVATE JSArrayBufferView(VM&, ConstructionContext&);
     JS_EXPORT_PRIVATE void finishCreation(VM&);
     
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
-    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
-    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
-    
-    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
     
 public:
     TypedArrayMode mode() const { return m_mode; }
     bool hasArrayBuffer() const { return JSC::hasArrayBuffer(mode()); }
     
-    ArrayBuffer* buffer();
-    PassRefPtr<ArrayBufferView> impl();
+    bool isShared();
+    JS_EXPORT_PRIVATE ArrayBuffer* unsharedBuffer();
+    ArrayBuffer* possiblySharedBuffer();
+    JSArrayBuffer* unsharedJSBuffer(ExecState* exec);
+    JSArrayBuffer* possiblySharedJSBuffer(ExecState* exec);
+    RefPtr<ArrayBufferView> unsharedImpl();
+    RefPtr<ArrayBufferView> possiblySharedImpl();
+    bool isNeutered() { return hasArrayBuffer() && !vector(); }
     void neuter();
     
-    void* vector() { return m_vector; }
+    void* vector() const { return m_vector.get(); }
+    
     unsigned byteOffset();
     unsigned length() const { return m_length; }
 
@@ -169,21 +177,28 @@ public:
     static ptrdiff_t offsetOfVector() { return OBJECT_OFFSETOF(JSArrayBufferView, m_vector); }
     static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(JSArrayBufferView, m_length); }
     static ptrdiff_t offsetOfMode() { return OBJECT_OFFSETOF(JSArrayBufferView, m_mode); }
+    
+    static RefPtr<ArrayBufferView> toWrapped(VM&, JSValue);
 
 private:
     static void finalize(JSCell*);
 
 protected:
-    static const unsigned StructureFlags = OverridesGetPropertyNames | OverridesGetOwnPropertySlot | Base::StructureFlags;
-    
+    friend class LLIntOffsetsExtractor;
+
     ArrayBuffer* existingBufferInButterfly();
 
-    void* m_vector;
+    static String toStringName(const JSObject*, ExecState*);
+
+    AuxiliaryBarrier<void*> m_vector;
     uint32_t m_length;
     TypedArrayMode m_mode;
 };
 
 } // namespace JSC
 
-#endif // JSArrayBufferView_h
+namespace WTF {
+
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::TypedArrayMode);
 
+} // namespace WTF