<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[191059] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/191059">191059</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2015-10-14 12:07:12 -0700 (Wed, 14 Oct 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>ES6 Fix TypedArray constructors.
https://bugs.webkit.org/show_bug.cgi?id=149975

Reviewed by Geoffrey Garen.

The ES6 spec requires that any object argument passed to a TypedArray constructor that is not a TypedArray
and has an iterator should use the iterator to construct the TypedArray. To avoid performance regressions related
to iterating we check if the iterator attached to the object points to the generic array iterator and length is a value.
If so, we do not use the iterator since there should be no observable difference. Another other interesting note is
that the ES6 spec has the of and from functions on a shared constructor between all the TypedArray constructors.
When the TypedArray is constructed the expectation is to crawl the prototype chain of the this value
passed to the function. If the function finds a known TypedArray constructor (Int32Array, Float64Array,...) then
it creates a TypedArray of that type. This is implemented by adding a private function (@allocateTypedArray) to each
of the constructors that can be called in order to construct the array. By using the private functions the JIT should
hopefully be able to optimize this to a direct call.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/TypedArrayConstructor.js: Added.
(of):
(from):
(allocateInt8Array):
(allocateInt16Array):
(allocateInt32Array):
(allocateUint32Array):
(allocateUint16Array):
(allocateUint8Array):
(allocateUint8ClampedArray):
(allocateFloat32Array):
(allocateFloat64Array):
* runtime/CommonIdentifiers.h:
* runtime/JSDataView.cpp:
(JSC::JSDataView::setIndex):
* runtime/JSDataView.h:
* runtime/JSGenericTypedArrayView.h:
(JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
* runtime/JSGenericTypedArrayViewConstructor.h:
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::finishCreation):
(JSC::JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::create):
(JSC::constructGenericTypedArrayViewFromIterator):
(JSC::constructGenericTypedArrayView):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/JSTypedArrayViewConstructor.cpp: Added.
(JSC::JSTypedArrayViewConstructor::JSTypedArrayViewConstructor):
(JSC::JSTypedArrayViewConstructor::finishCreation):
(JSC::JSTypedArrayViewConstructor::create):
(JSC::JSTypedArrayViewConstructor::createStructure):
(JSC::constructTypedArrayView):
(JSC::JSTypedArrayViewConstructor::getConstructData):
(JSC::JSTypedArrayViewConstructor::getCallData):
* runtime/JSTypedArrayViewConstructor.h: Copied from Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h.
* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::JSTypedArrayViewPrototype::create):
* tests/es6.yaml:
* tests/stress/resources/typedarray-constructor-helper-functions.js: Added.
(forEachTypedArray):
(hasSameValues):
(foo):
(testConstructorFunction):
(testConstructor):
* tests/stress/typedarray-constructor.js: Added.
(A):
(iterator.return.next):
(iterator):
(obj.valueOf):
(iterator2.return.next):
(iterator2):
* tests/stress/typedarray-from.js: Added.
(even):
(isBigEnoughAndException):
* tests/stress/typedarray-of.js: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonIdentifiersh">trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewcpp">trunk/Source/JavaScriptCore/runtime/JSDataView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewh">trunk/Source/JavaScriptCore/runtime/JSDataView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoretestses6yaml">trunk/Source/JavaScriptCore/tests/es6.yaml</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCorebuiltinsTypedArrayConstructorjs">trunk/Source/JavaScriptCore/builtins/TypedArrayConstructor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorh">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressresourcestypedarrayconstructorhelperfunctionsjs">trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-constructor-helper-functions.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayconstructorjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-constructor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayfromjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-from.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayofjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-of.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -575,6 +575,7 @@
</span><span class="cx">     runtime/JSTemplateRegistryKey.cpp
</span><span class="cx">     runtime/JSTypedArrayConstructors.cpp
</span><span class="cx">     runtime/JSTypedArrayPrototypes.cpp
</span><ins>+    runtime/JSTypedArrayViewConstructor.cpp
</ins><span class="cx">     runtime/JSTypedArrayViewPrototype.cpp
</span><span class="cx">     runtime/JSTypedArrays.cpp
</span><span class="cx">     runtime/JSWeakMap.cpp
</span><span class="lines">@@ -1092,6 +1093,7 @@
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/StringConstructor.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/StringIterator.prototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/TypedArray.prototype.js
</span><ins>+    ${JAVASCRIPTCORE_DIR}/builtins/TypedArrayConstructor.js
</ins><span class="cx"> )
</span><span class="cx"> 
</span><span class="cx"> add_custom_command(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/ChangeLog        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1,3 +1,82 @@
</span><ins>+2015-10-14  Keith Miller  &lt;keith_miller@apple.com&gt;
+
+        ES6 Fix TypedArray constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=149975
+
+        Reviewed by Geoffrey Garen.
+
+        The ES6 spec requires that any object argument passed to a TypedArray constructor that is not a TypedArray
+        and has an iterator should use the iterator to construct the TypedArray. To avoid performance regressions related
+        to iterating we check if the iterator attached to the object points to the generic array iterator and length is a value.
+        If so, we do not use the iterator since there should be no observable difference. Another other interesting note is
+        that the ES6 spec has the of and from functions on a shared constructor between all the TypedArray constructors.
+        When the TypedArray is constructed the expectation is to crawl the prototype chain of the this value
+        passed to the function. If the function finds a known TypedArray constructor (Int32Array, Float64Array,...) then
+        it creates a TypedArray of that type. This is implemented by adding a private function (@allocateTypedArray) to each
+        of the constructors that can be called in order to construct the array. By using the private functions the JIT should
+        hopefully be able to optimize this to a direct call.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/TypedArrayConstructor.js: Added.
+        (of):
+        (from):
+        (allocateInt8Array):
+        (allocateInt16Array):
+        (allocateInt32Array):
+        (allocateUint32Array):
+        (allocateUint16Array):
+        (allocateUint8Array):
+        (allocateUint8ClampedArray):
+        (allocateFloat32Array):
+        (allocateFloat64Array):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::setIndex):
+        * runtime/JSDataView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
+        * runtime/JSGenericTypedArrayViewConstructor.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::finishCreation):
+        (JSC::JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::create):
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSTypedArrayViewConstructor.cpp: Added.
+        (JSC::JSTypedArrayViewConstructor::JSTypedArrayViewConstructor):
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        (JSC::JSTypedArrayViewConstructor::create):
+        (JSC::JSTypedArrayViewConstructor::createStructure):
+        (JSC::constructTypedArrayView):
+        (JSC::JSTypedArrayViewConstructor::getConstructData):
+        (JSC::JSTypedArrayViewConstructor::getCallData):
+        * runtime/JSTypedArrayViewConstructor.h: Copied from Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h.
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::create):
+        * tests/es6.yaml:
+        * tests/stress/resources/typedarray-constructor-helper-functions.js: Added.
+        (forEachTypedArray):
+        (hasSameValues):
+        (foo):
+        (testConstructorFunction):
+        (testConstructor):
+        * tests/stress/typedarray-constructor.js: Added.
+        (A):
+        (iterator.return.next):
+        (iterator):
+        (obj.valueOf):
+        (iterator2.return.next):
+        (iterator2):
+        * tests/stress/typedarray-from.js: Added.
+        (even):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-of.js: Added.
+
</ins><span class="cx"> 2015-10-14  Mark Lam  &lt;mark.lam@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Rename some JSC option names to be more uniform.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -976,6 +976,8 @@
</span><span class="cx">                 52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 52C952B719A289850069B386 /* TypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C952B619A289850069B386 /* TypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 52C952B919A28A1C0069B386 /* TypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52C952B819A28A1C0069B386 /* TypeProfiler.cpp */; };
</span><ins>+                534C457C1BC72411007476A7 /* JSTypedArrayViewConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */; };
+                534C457E1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */; };
</ins><span class="cx">                 53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
</span><span class="cx">                 5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
</span><span class="cx">                 5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
</span><span class="lines">@@ -2800,6 +2802,9 @@
</span><span class="cx">                 52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeType.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 52C952B619A289850069B386 /* TypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeProfiler.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 52C952B819A28A1C0069B386 /* TypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeProfiler.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                534C457A1BC703DC007476A7 /* TypedArrayConstructor.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = TypedArrayConstructor.js; sourceTree = &quot;&lt;group&gt;&quot;; };
+                534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewConstructor.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayViewConstructor.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewPrototypeFunctions.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewPrototype.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 53917E831B791CB8000EBD33 /* TypedArray.prototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = TypedArray.prototype.js; path = builtins/TypedArray.prototype.js; sourceTree = SOURCE_ROOT; };
</span><span class="lines">@@ -4919,6 +4924,8 @@
</span><span class="cx">                                 0F2B66CF17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h */,
</span><span class="cx">                                 0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */,
</span><span class="cx">                                 0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */,
</span><ins>+                                534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */,
+                                534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */,
</ins><span class="cx">                                 53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */,
</span><span class="cx">                                 53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */,
</span><span class="cx">                                 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
</span><span class="lines">@@ -5919,6 +5926,7 @@
</span><span class="cx">                                 7CF9BC601B65D9B1009DB1EF /* StringConstructor.js */,
</span><span class="cx">                                 7CF9BC611B65D9B1009DB1EF /* StringIterator.prototype.js */,
</span><span class="cx">                                 53917E831B791CB8000EBD33 /* TypedArray.prototype.js */,
</span><ins>+                                534C457A1BC703DC007476A7 /* TypedArrayConstructor.js */,
</ins><span class="cx">                         );
</span><span class="cx">                         path = builtins;
</span><span class="cx">                         sourceTree = &quot;&lt;group&gt;&quot;;
</span><span class="lines">@@ -6592,6 +6600,7 @@
</span><span class="cx">                                 797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */,
</span><span class="cx">                                 BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
</span><span class="cx">                                 A5FD0086189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h in Headers */,
</span><ins>+                                534C457C1BC72411007476A7 /* JSTypedArrayViewConstructor.h in Headers */,
</ins><span class="cx">                                 A5C3A1A618C0490200C9593A /* JSGlobalObjectConsoleClient.h in Headers */,
</span><span class="cx">                                 A59455931824744700CC3843 /* JSGlobalObjectDebuggable.h in Headers */,
</span><span class="cx">                                 A57D23EA1891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h in Headers */,
</span><span class="lines">@@ -8029,6 +8038,7 @@
</span><span class="cx">                                 6540C7A01B82E1C3000F6B79 /* RegisterAtOffset.cpp in Sources */,
</span><span class="cx">                                 6540C7A11B82E1C3000F6B79 /* RegisterAtOffsetList.cpp in Sources */,
</span><span class="cx">                                 0FC3141518146D7000033232 /* RegisterSet.cpp in Sources */,
</span><ins>+                                534C457E1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp in Sources */,
</ins><span class="cx">                                 A57D23ED1891B5540031C7FA /* RegularExpression.cpp in Sources */,
</span><span class="cx">                                 A5BA15E9182340B300A82E69 /* RemoteInspector.mm in Sources */,
</span><span class="cx">                                 A594558F18245EFD00CC3843 /* RemoteInspectorDebuggable.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsTypedArrayConstructorjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/builtins/TypedArrayConstructor.js (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/TypedArrayConstructor.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/builtins/TypedArrayConstructor.js        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,181 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// According to the spec we are supposed to crawl the prototype chain looking
+// for the a TypedArray constructor. The way we implement this is with a
+// private function, @alloctateTypedArray, on each of the prototypes.
+// This enables us to optimize this lookup in the inline cache.
+
+function of(/* items... */)
+{
+    &quot;use strict&quot;;
+    let len = arguments.length;
+    let constructFunction = this.@allocateTypedArray;
+    if (constructFunction === undefined)
+        throw new @TypeError(&quot;TypedArray.from requires its this argument to subclass a TypedArray constructor&quot;);
+
+    let result = constructFunction(len);
+
+    for (let i = 0; i &lt; len; i++)
+        result[i] = arguments[i];
+
+    return result;
+}
+
+function from(items /* [ , mapfn [ , thisArg ] ] */)
+{
+    &quot;use strict&quot;;
+
+    let mapFn = arguments[1];
+
+    let thisArg;
+
+    if (mapFn !== undefined) {
+        if (typeof mapFn !== &quot;function&quot;)
+            throw new @TypeError(&quot;TypedArray.from requires that the second argument, when provided, be a function&quot;);
+
+        if (arguments.length &gt; 2)
+            thisArg = arguments[2];
+    }
+
+    if (items == null)
+        throw new @TypeError(&quot;TypedArray.from requires an array-like object - not null or undefined&quot;);
+
+    let iteratorMethod = items[@symbolIterator];
+    if (iteratorMethod != null) {
+        if (typeof iteratorMethod !== &quot;function&quot;)
+            throw new @TypeError(&quot;TypedArray.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function&quot;);
+
+        let accumulator = [];
+
+        let k = 0;
+        let iterator = iteratorMethod.@call(items);
+
+        // Since for-of loop once more looks up the @@iterator property of a given iterable,
+        // it could be observable if the user defines a getter for @@iterator.
+        // To avoid this situation, we define a wrapper object that @@iterator just returns a given iterator.
+        let wrapper = {
+            [@symbolIterator]() {
+                return iterator;
+            }
+        };
+
+
+        for (let value of wrapper) {
+            if (mapFn)
+                @putByValDirect(accumulator, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+            else
+                @putByValDirect(accumulator, k, value);
+            k++;
+        }
+
+        let constructFunction = this.@allocateTypedArray;
+        if (constructFunction === undefined)
+            throw new @TypeError(&quot;TypedArray.from requires its this argument subclass a TypedArray constructor&quot;);
+
+        let result = constructFunction(k);
+
+        for (let i = 0; i &lt; k; i++) 
+            result[i] = accumulator[i];
+
+
+        return result;
+    }
+
+    let arrayLike = @Object(items);
+    let arrayLikeLength = @toLength(arrayLike.length);
+
+    let constructFunction = this.@allocateTypedArray;
+    if (constructFunction === undefined)
+        throw new @TypeError(&quot;this does not subclass a TypedArray constructor&quot;);
+
+    let result = constructFunction(arrayLikeLength);
+
+    let k = 0;
+    while (k &lt; arrayLikeLength) {
+        let value = arrayLike[k];
+        if (mapFn)
+            result[k] = thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k);
+        else
+            result[k] = value;
+        k++;
+    }
+
+    return result;
+}
+
+function allocateInt8Array(length) {
+
+    return new @Int8Array(length);
+
+}
+
+function allocateInt16Array(length) {
+
+    return new @Int16Array(length);
+    
+}
+
+function allocateInt32Array(length) {
+
+    return new @Int32Array(length);
+    
+}
+
+function allocateUint32Array(length) {
+
+    return new @Uint32Array(length);
+
+}
+
+function allocateUint16Array(length) {
+
+    return new @Uint16Array(length);
+    
+}
+
+function allocateUint8Array(length) {
+
+    return new @Uint8Array(length);
+    
+}
+
+function allocateUint8ClampedArray(length) {
+
+    return new @Uint8ClampedArray(length);
+
+}
+
+function allocateFloat32Array(length) {
+
+    return new @Float32Array(length);
+
+}
+
+function allocateFloat64Array(length) {
+
+    return new @Float64Array(length);
+
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -310,6 +310,16 @@
</span><span class="cx">     macro(InspectorInstrumentation) \
</span><span class="cx">     macro(get) \
</span><span class="cx">     macro(set) \
</span><ins>+    macro(allocateTypedArray) \
+    macro(Int8Array) \
+    macro(Int16Array) \
+    macro(Int32Array) \
+    macro(Uint8Array) \
+    macro(Uint8ClampedArray) \
+    macro(Uint16Array) \
+    macro(Uint32Array) \
+    macro(Float32Array) \
+    macro(Float64Array) \
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataView.cpp (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataView.cpp        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSDataView.cpp        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -83,6 +83,12 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool JSDataView::setIndex(ExecState*, unsigned, JSValue)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return false;
+}
+
</ins><span class="cx"> PassRefPtr&lt;DataView&gt; JSDataView::typedImpl()
</span><span class="cx"> {
</span><span class="cx">     return DataView::create(buffer(), byteOffset(), length());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataView.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataView.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSDataView.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -49,6 +49,7 @@
</span><span class="cx">     static JSDataView* createUninitialized(ExecState*, Structure*, unsigned length);
</span><span class="cx">     static JSDataView* create(ExecState*, Structure*, unsigned length);
</span><span class="cx">     bool set(ExecState*, JSObject*, unsigned offset, unsigned length);
</span><ins>+    bool setIndex(ExecState*, unsigned, JSValue);
</ins><span class="cx">     
</span><span class="cx">     ArrayBuffer* buffer() const { return m_buffer; }
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -171,13 +171,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Optional&lt;typename Adaptor::Type&gt; toAdaptorNativeFromValue(ExecState* exec, JSValue jsValue)
-    {
-        typename Adaptor::Type value = toNativeFromValue&lt;Adaptor&gt;(exec, jsValue);
-        if (exec-&gt;hadException())
-            return Nullopt;
-        return value;
-    }
</del><ins>+    static ElementType toAdaptorNativeFromValue(ExecState* exec, JSValue jsValue) { return toNativeFromValue&lt;Adaptor&gt;(exec, jsValue); }
</ins><span class="cx"> 
</span><span class="cx">     bool setRangeToValue(ExecState* exec, unsigned start, unsigned end, JSValue jsValue)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,11 +37,11 @@
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     JSGenericTypedArrayViewConstructor(VM&amp;, Structure*);
</span><del>-    void finishCreation(VM&amp;, JSObject* prototype, const String&amp; name);
</del><ins>+    void finishCreation(VM&amp;, JSGlobalObject*, JSObject* prototype, const String&amp; name, FunctionExecutable* privateAllocator);
</ins><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     static JSGenericTypedArrayViewConstructor* create(
</span><del>-        VM&amp;, Structure*, JSObject* prototype, const String&amp; name);
</del><ins>+        VM&amp;, JSGlobalObject*, Structure*, JSObject* prototype, const String&amp; name, FunctionExecutable* privateAllocator);
</ins><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -27,9 +27,13 @@
</span><span class="cx"> #define JSGenericTypedArrayViewConstructorInlines_h
</span><span class="cx"> 
</span><span class="cx"> #include &quot;Error.h&quot;
</span><ins>+#include &quot;IteratorOperations.h&quot;
</ins><span class="cx"> #include &quot;JSArrayBuffer.h&quot;
</span><ins>+#include &quot;JSCJSValueInlines.h&quot;
+#include &quot;JSDataView.h&quot;
</ins><span class="cx"> #include &quot;JSGenericTypedArrayViewConstructor.h&quot;
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><ins>+#include &quot;StructureInlines.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -40,24 +44,27 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-void JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::finishCreation(VM&amp; vm, JSObject* prototype, const String&amp; name)
</del><ins>+void JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, JSObject* prototype, const String&amp; name, FunctionExecutable* privateAllocator)
</ins><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, name);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(3), DontEnum | DontDelete | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), DontEnum | ReadOnly | DontDelete);
</span><ins>+
+    if (privateAllocator)
+        putDirectBuiltinFunction(vm, globalObject, vm.propertyNames-&gt;allocateTypedArrayPrivateName, privateAllocator, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><span class="cx"> JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;*
</span><span class="cx"> JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::create(
</span><del>-    VM&amp; vm, Structure* structure, JSObject* prototype,
-    const String&amp; name)
</del><ins>+    VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, JSObject* prototype,
+    const String&amp; name, FunctionExecutable* privateAllocator)
</ins><span class="cx"> {
</span><span class="cx">     JSGenericTypedArrayViewConstructor* result =
</span><span class="cx">         new (NotNull, allocateCell&lt;JSGenericTypedArrayViewConstructor&gt;(vm.heap))
</span><span class="cx">         JSGenericTypedArrayViewConstructor(vm, structure);
</span><del>-    result-&gt;finishCreation(vm, prototype, name);
</del><ins>+    result-&gt;finishCreation(vm, globalObject, prototype, name, privateAllocator);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -70,12 +77,52 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><ins>+static EncodedJSValue constructGenericTypedArrayViewFromIterator(ExecState* exec, Structure* structure, JSValue iterator)
+{
+    if (!iterator.isObject())
+        return JSValue::encode(throwTypeError(exec, &quot;Symbol.Iterator for the first argument did not return an object.&quot;));
+
+    MarkedArgumentBuffer storage;
+    while (true) {
+        JSValue next = iteratorStep(exec, iterator);
+        if (exec-&gt;hadException())
+            return JSValue::encode(jsUndefined());
+
+        if (next.isFalse())
+            break;
+
+        JSValue nextItem = iteratorValue(exec, next);
+        if (exec-&gt;hadException())
+            return JSValue::encode(jsUndefined());
+
+        storage.append(nextItem);
+    }
+
+    ViewClass* result = ViewClass::createUninitialized(exec, structure, storage.size());
+    if (!result) {
+        ASSERT(exec-&gt;hadException());
+        return JSValue::encode(jsUndefined());
+    }
+
+    for (unsigned i = 0; i &lt; storage.size(); ++i) {
+        if (!result-&gt;setIndex(exec, i, storage.at(i))) {
+            ASSERT(exec-&gt;hadException());
+            return JSValue::encode(jsUndefined());
+        }
+    }
+
+    return JSValue::encode(result);
+}
+
+template&lt;typename ViewClass&gt;
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     Structure* structure =
</span><span class="cx">         asInternalFunction(exec-&gt;callee())-&gt;globalObject()-&gt;typedArrayStructure(
</span><span class="cx">             ViewClass::TypedArrayStorageType);
</span><del>-    
</del><ins>+
+    VM&amp; vm = exec-&gt;vm();
+
</ins><span class="cx">     if (!exec-&gt;argumentCount()) {
</span><span class="cx">         if (ViewClass::TypedArrayStorageType == TypeDataView)
</span><span class="cx">             return throwVMError(exec, createTypeError(exec, &quot;DataView constructor requires at least one argument.&quot;));
</span><span class="lines">@@ -113,8 +160,41 @@
</span><span class="cx">     // - An integer. This creates a new typed array of that length and zero-initializes it.
</span><span class="cx">     
</span><span class="cx">     if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;uncheckedArgument(0))) {
</span><del>-        unsigned length =
-            object-&gt;get(exec, exec-&gt;vm().propertyNames-&gt;length).toUInt32(exec);
</del><ins>+        PropertySlot lengthSlot(object);
+        object-&gt;getPropertySlot(exec, vm.propertyNames-&gt;length, lengthSlot);
+
+        if (!isTypedView(object-&gt;classInfo()-&gt;typedArrayStorageType)) {
+            JSValue iteratorFunc = object-&gt;get(exec, vm.propertyNames-&gt;iteratorSymbol);
+            if (exec-&gt;hadException())
+                return JSValue::encode(jsUndefined());
+
+            // We would like not use the iterator as it is painfully slow. Fortunately, unless
+            // 1) The iterator is not a known iterator.
+            // 2) The base object does not have a length getter.
+            // 3) Bad times are being had.
+            // it should not be observable that we do not use the iterator.
+
+            if (!iteratorFunc.isUndefined()
+                &amp;&amp; (iteratorFunc != exec-&gt;lexicalGlobalObject()-&gt;arrayProtoValuesFunction()
+                    || lengthSlot.isAccessor() || lengthSlot.isCustom()
+                    || exec-&gt;lexicalGlobalObject()-&gt;isHavingABadTime())) {
+
+                    CallData callData;
+                    CallType callType = getCallData(iteratorFunc, callData);
+                    if (callType == CallTypeNone)
+                        return JSValue::encode(throwTypeError(exec, &quot;Symbol.Iterator for the first argument cannot be called.&quot;));
+
+                    ArgList arguments;
+                    JSValue iterator = call(exec, iteratorFunc, callType, callData, object, arguments);
+                    if (exec-&gt;hadException())
+                        return JSValue::encode(jsUndefined());
+
+                    return constructGenericTypedArrayViewFromIterator&lt;ViewClass&gt;(exec, structure, iterator);
+
+            }
+        }
+
+        unsigned length = lengthSlot.getValue(exec, vm.propertyNames-&gt;length).toUInt32(exec);
</ins><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -160,13 +160,11 @@
</span><span class="cx">     JSValue valueToFind = exec-&gt;argument(0);
</span><span class="cx">     unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
</span><span class="cx"> 
</span><del>-    auto targetOpt = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
-    if (!targetOpt)
</del><ins>+    typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
+    typename ViewClass::ElementType target = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
+    if (exec-&gt;hadException())
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    typename ViewClass::ElementType target = targetOpt.value();
-    typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
-
</del><span class="cx">     for (; index &lt; length; ++index) {
</span><span class="cx">         if (array[index] == target)
</span><span class="cx">             return JSValue::encode(jsNumber(index));
</span><span class="lines">@@ -245,14 +243,11 @@
</span><span class="cx">             index = static_cast&lt;unsigned&gt;(fromDouble);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    auto targetOpt = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
-    if (!targetOpt)
</del><ins>+    typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
+    typename ViewClass::ElementType target = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
+    if (exec-&gt;hadException())
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    typename ViewClass::ElementType target = targetOpt.value();
-    typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
-
-
</del><span class="cx">     for (; index &gt;= 0; --index) {
</span><span class="cx">         if (array[index] == target)
</span><span class="cx">             return JSValue::encode(jsNumber(index));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -99,6 +99,7 @@
</span><span class="cx"> #include &quot;JSTemplateRegistryKey.h&quot;
</span><span class="cx"> #include &quot;JSTypedArrayConstructors.h&quot;
</span><span class="cx"> #include &quot;JSTypedArrayPrototypes.h&quot;
</span><ins>+#include &quot;JSTypedArrayViewConstructor.h&quot;
</ins><span class="cx"> #include &quot;JSTypedArrayViewPrototype.h&quot;
</span><span class="cx"> #include &quot;JSTypedArrays.h&quot;
</span><span class="cx"> #include &quot;JSWASMModule.h&quot;
</span><span class="lines">@@ -460,23 +461,36 @@
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;Math, MathObject::create(vm, this, MathObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;Reflect, ReflectObject::create(vm, this, ReflectObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
</span><span class="cx"> 
</span><ins>+    JSTypedArrayViewConstructor* typedArraySuperConstructor = JSTypedArrayViewConstructor::create(vm, this, JSTypedArrayViewConstructor::createStructure(vm, this, m_functionPrototype.get()), typedArrayProto);
+    typedArrayProto-&gt;putDirectWithoutTransition(vm, vm.propertyNames-&gt;constructor, typedArraySuperConstructor, DontEnum);
+
</ins><span class="cx">     std::array&lt;InternalFunction*, NUMBER_OF_TYPED_ARRAY_TYPES&gt; typedArrayConstructors;
</span><del>-    typedArrayConstructors[toIndex(TypeInt8)] = JSInt8ArrayConstructor::create(vm, JSInt8ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeInt8)].prototype.get(), ASCIILiteral(&quot;Int8Array&quot;));
-    typedArrayConstructors[toIndex(TypeInt16)] = JSInt16ArrayConstructor::create(vm, JSInt16ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeInt16)].prototype.get(), ASCIILiteral(&quot;Int16Array&quot;));
-    typedArrayConstructors[toIndex(TypeInt32)] = JSInt32ArrayConstructor::create(vm, JSInt32ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeInt32)].prototype.get(), ASCIILiteral(&quot;Int32Array&quot;));
-    typedArrayConstructors[toIndex(TypeUint8)] = JSUint8ArrayConstructor::create(vm, JSUint8ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeUint8)].prototype.get(), ASCIILiteral(&quot;Uint8Array&quot;));
-    typedArrayConstructors[toIndex(TypeUint8Clamped)] = JSUint8ClampedArrayConstructor::create(vm, JSUint8ClampedArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get(), ASCIILiteral(&quot;Uint8ClampedArray&quot;));
-    typedArrayConstructors[toIndex(TypeUint16)] = JSUint16ArrayConstructor::create(vm, JSUint16ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeUint16)].prototype.get(), ASCIILiteral(&quot;Uint16Array&quot;));
-    typedArrayConstructors[toIndex(TypeUint32)] = JSUint32ArrayConstructor::create(vm, JSUint32ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeUint32)].prototype.get(), ASCIILiteral(&quot;Uint32Array&quot;));
-    typedArrayConstructors[toIndex(TypeFloat32)] = JSFloat32ArrayConstructor::create(vm, JSFloat32ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeFloat32)].prototype.get(), ASCIILiteral(&quot;Float32Array&quot;));
-    typedArrayConstructors[toIndex(TypeFloat64)] = JSFloat64ArrayConstructor::create(vm, JSFloat64ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeFloat64)].prototype.get(), ASCIILiteral(&quot;Float64Array&quot;));
-    typedArrayConstructors[toIndex(TypeDataView)] = JSDataViewConstructor::create(vm, JSDataViewConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeDataView)].prototype.get(), ASCIILiteral(&quot;DataView&quot;));
</del><ins>+    typedArrayConstructors[toIndex(TypeInt8)] = JSInt8ArrayConstructor::create(vm, this, JSInt8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt8)].prototype.get(), ASCIILiteral(&quot;Int8Array&quot;), typedArrayConstructorAllocateInt8ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeInt16)] = JSInt16ArrayConstructor::create(vm, this, JSInt16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt16)].prototype.get(), ASCIILiteral(&quot;Int16Array&quot;), typedArrayConstructorAllocateInt16ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeInt32)] = JSInt32ArrayConstructor::create(vm, this, JSInt32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt32)].prototype.get(), ASCIILiteral(&quot;Int32Array&quot;), typedArrayConstructorAllocateInt32ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeUint8)] = JSUint8ArrayConstructor::create(vm, this, JSUint8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8)].prototype.get(), ASCIILiteral(&quot;Uint8Array&quot;), typedArrayConstructorAllocateUint8ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeUint8Clamped)] = JSUint8ClampedArrayConstructor::create(vm, this, JSUint8ClampedArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get(), ASCIILiteral(&quot;Uint8ClampedArray&quot;), typedArrayConstructorAllocateUint8ClampedArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeUint16)] = JSUint16ArrayConstructor::create(vm, this, JSUint16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint16)].prototype.get(), ASCIILiteral(&quot;Uint16Array&quot;), typedArrayConstructorAllocateUint16ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeUint32)] = JSUint32ArrayConstructor::create(vm, this, JSUint32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint32)].prototype.get(), ASCIILiteral(&quot;Uint32Array&quot;), typedArrayConstructorAllocateUint32ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeFloat32)] = JSFloat32ArrayConstructor::create(vm, this, JSFloat32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat32)].prototype.get(), ASCIILiteral(&quot;Float32Array&quot;), typedArrayConstructorAllocateFloat32ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeFloat64)] = JSFloat64ArrayConstructor::create(vm, this, JSFloat64ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat64)].prototype.get(), ASCIILiteral(&quot;Float64Array&quot;), typedArrayConstructorAllocateFloat64ArrayCodeGenerator(vm));
+    typedArrayConstructors[toIndex(TypeDataView)] = JSDataViewConstructor::create(vm, this, JSDataViewConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeDataView)].prototype.get(), ASCIILiteral(&quot;DataView&quot;), nullptr);
</ins><span class="cx">     
</span><span class="cx">     for (unsigned typedArrayIndex = NUMBER_OF_TYPED_ARRAY_TYPES; typedArrayIndex--;) {
</span><span class="cx">         m_typedArrays[typedArrayIndex].prototype-&gt;putDirectWithoutTransition(vm, vm.propertyNames-&gt;constructor, typedArrayConstructors[typedArrayIndex], DontEnum);
</span><span class="cx">         putDirectWithoutTransition(vm, Identifier::fromString(exec, typedArrayConstructors[typedArrayIndex]-&gt;name(exec)), typedArrayConstructors[typedArrayIndex], DontEnum);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Int8ArrayPrivateName, typedArrayConstructors[toIndex(TypeInt8)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Int16ArrayPrivateName, typedArrayConstructors[toIndex(TypeInt16)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Int32ArrayPrivateName, typedArrayConstructors[toIndex(TypeInt32)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Uint8ArrayPrivateName, typedArrayConstructors[toIndex(TypeUint8)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Uint8ClampedArrayPrivateName, typedArrayConstructors[toIndex(TypeUint8Clamped)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Uint16ArrayPrivateName, typedArrayConstructors[toIndex(TypeUint16)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Uint32ArrayPrivateName, typedArrayConstructors[toIndex(TypeUint32)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Float32ArrayPrivateName, typedArrayConstructors[toIndex(TypeFloat32)], DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;Float64ArrayPrivateName, typedArrayConstructors[toIndex(TypeFloat64)], DontEnum);
+
</ins><span class="cx">     m_moduleLoader.set(vm, this, ModuleLoaderObject::create(vm, this, ModuleLoaderObject::createStructure(vm, this, m_objectPrototype.get())));
</span><span class="cx">     if (Options::exposeInternalModuleLoader())
</span><span class="cx">         putDirectWithoutTransition(vm, vm.propertyNames-&gt;Loader, m_moduleLoader.get(), DontEnum);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,124 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;JSTypedArrayViewConstructor.h&quot;
+
+#include &quot;CallFrame.h&quot;
+#include &quot;Error.h&quot;
+#include &quot;JSCBuiltins.h&quot;
+#include &quot;JSCellInlines.h&quot;
+#include &quot;JSGenericTypedArrayViewConstructorInlines.h&quot;
+#include &quot;JSObject.h&quot;
+#include &quot;JSTypedArrays.h&quot;
+
+namespace JSC {
+
+JSTypedArrayViewConstructor::JSTypedArrayViewConstructor(VM&amp; vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+const ClassInfo JSTypedArrayViewConstructor::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSTypedArrayViewConstructor) };
+
+void JSTypedArrayViewConstructor::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, JSObject* prototype)
+{
+    Base::finishCreation(vm, &quot;TypedArray&quot;);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(3), DontEnum | DontDelete | ReadOnly);
+
+    JSC_BUILTIN_FUNCTION(vm.propertyNames-&gt;of, typedArrayConstructorOfCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION(vm.propertyNames-&gt;from, typedArrayConstructorFromCodeGenerator, DontEnum);
+}
+
+JSTypedArrayViewConstructor* JSTypedArrayViewConstructor::create(
+    VM&amp; vm, JSGlobalObject* globalObject, Structure* structure,
+    JSObject* prototype)
+{
+    JSTypedArrayViewConstructor* result = new (NotNull, allocateCell&lt;JSTypedArrayViewConstructor&gt;(vm.heap)) JSTypedArrayViewConstructor(vm, structure);
+    result-&gt;finishCreation(vm, globalObject, prototype);
+    return result;
+}
+
+Structure* JSTypedArrayViewConstructor::createStructure(
+    VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+
+// The only way we can call this function is through Reflect.construct or if they mucked with the TypedArray prototype chain.
+// In either case we are ok with this being slow.
+static EncodedJSValue JSC_HOST_CALL constructTypedArrayView(ExecState* exec)
+{
+    JSValue value = exec-&gt;newTarget();
+
+    JSObject* object = jsDynamicCast&lt;JSObject*&gt;(value);
+    if (!object)
+        return JSValue::encode(throwTypeError(exec, &quot;new.target passed to TypedArray is not an object.&quot;));
+
+    ConstructData data;
+    if (object-&gt;methodTable()-&gt;getConstructData(object, data) == ConstructTypeNone)
+        return JSValue::encode(throwTypeError(exec, &quot;new.target passed to TypedArray is not a valid constructor.&quot;));
+
+    for (; !value.isNull(); value = jsCast&lt;JSObject*&gt;(value)-&gt;prototype()) {
+        if (jsDynamicCast&lt;JSTypedArrayViewConstructor*&gt;(value))
+            return JSValue::encode(throwTypeError(exec, &quot;Unable to find TypedArray constructor that inherits from TypedArray.&quot;));
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSInt8Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSInt8Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSInt16Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSInt16Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSInt32Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSInt32Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSUint8Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSUint8Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSUint16Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSUint16Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSUint32Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSUint32Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSUint8ClampedArray&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSUint8ClampedArray&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSFloat32Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSFloat32Array&gt;(exec);
+        if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSFloat64Array&gt;*&gt;(value))
+            return constructGenericTypedArrayView&lt;JSFloat64Array&gt;(exec);
+    }
+    
+    return JSValue::encode(throwTypeError(exec, &quot;Unable to find TypedArray constructor in prototype-chain, hit null.&quot;));
+}
+
+ConstructType JSTypedArrayViewConstructor::getConstructData(JSCell*, ConstructData&amp; constructData)
+{
+    constructData.native.function = constructTypedArrayView;
+    return ConstructTypeHost;
+}
+
+CallType JSTypedArrayViewConstructor::getCallData(JSCell*, CallData&amp; callData)
+{
+    callData.native.function = nullptr;
+    return CallTypeNone;
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorhfromrev191058trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h (from rev 191058, trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h) (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,56 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSTypedArrayViewConstructor_h
+#define JSTypedArrayViewConstructor_h
+
+#include &quot;InternalFunction.h&quot;
+
+namespace JSC {
+
+class JSTypedArrayViewConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+protected:
+    JSTypedArrayViewConstructor(VM&amp;, Structure*);
+    void finishCreation(VM&amp;, JSGlobalObject*, JSObject* prototype);
+
+public:
+    static JSTypedArrayViewConstructor* create(VM&amp;, JSGlobalObject*, Structure*, JSObject* prototype);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue prototype);
+protected:
+    static ConstructType getConstructData(JSCell*, ConstructData&amp;);
+    static CallType getCallData(JSCell*, CallData&amp;);
+};
+
+
+    
+} // namespace JSC
+
+#endif /* JSTypedArrayViewConstructor_h */
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -251,8 +251,8 @@
</span><span class="cx">     VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx"> {
</span><span class="cx">     JSTypedArrayViewPrototype* prototype =
</span><del>-    new (NotNull, allocateCell&lt;JSTypedArrayViewPrototype&gt;(vm.heap))
-    JSTypedArrayViewPrototype(vm, structure);
</del><ins>+        new (NotNull, allocateCell&lt;JSTypedArrayViewPrototype&gt;(vm.heap))
+        JSTypedArrayViewPrototype(vm, structure);
</ins><span class="cx">     prototype-&gt;finishCreation(vm, globalObject);
</span><span class="cx">     return prototype;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestses6yaml"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/es6.yaml (191058 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/es6.yaml        2015-10-14 18:57:07 UTC (rev 191058)
+++ trunk/Source/JavaScriptCore/tests/es6.yaml        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -1115,9 +1115,9 @@
</span><span class="cx"> - path: es6/String.prototype_methods_String.prototype.normalize.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/typed_arrays_%TypedArray%.from.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/typed_arrays_%TypedArray%.of.js
</span><del>-  cmd: runES6 :fail
</del><ins>+  cmd: runES6 :normal
</ins><span class="cx"> - path: es6/typed_arrays_%TypedArray%.prototype.copyWithin.js
</span><span class="cx">   cmd: runES6 :normal
</span><span class="cx"> - path: es6/typed_arrays_%TypedArray%.prototype.entries.js
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressresourcestypedarrayconstructorhelperfunctionsjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-constructor-helper-functions.js (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-constructor-helper-functions.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-constructor-helper-functions.js        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,60 @@
</span><ins>+load(&quot;./resources/standalone-pre.js&quot;);
+
+&quot;use strict&quot;;
+
+var typedArrays = [&quot;Int8Array&quot;, &quot;Uint8Array&quot;, &quot;Uint8ClampedArray&quot;, &quot;Int16Array&quot;, &quot;Uint16Array&quot;, &quot;Int32Array&quot;, &quot;Uint32Array&quot;, &quot;Float32Array&quot;, &quot;Float64Array&quot;];
+
+function forEachTypedArray(constructors, testFunction, name, args) {
+    for (let i = 0; i &lt; constructors.length; ++i) {
+        let typedArray = constructors[i];
+
+        let result;
+        if (name !== &quot;&quot;)
+            result = eval(typedArray + &quot;.&quot; + name + args)
+        else
+            result = eval(&quot;new &quot; + typedArray + args)
+
+        let testResult = testFunction(result, typedArray)
+        if (testResult !== true)
+            return testResult;
+    }
+
+    return true;
+}
+
+function hasSameValues(msg, array1, array2) {
+    if (array1.length !== array2.length) {
+        debug(msg +  &quot;The arrays had differing lengths, first array: &quot; + array1 + &quot; length: &quot; + array1.length + &quot; second array: &quot; + array2 + &quot; length&quot; + array2.length);
+        return false;
+    }
+
+    let allSame = true;
+    for (let i = 0; i &lt; array1.length; ++i) {
+        allSame = allSame &amp;&amp; Object.is(array1[i], array2[i]);
+    }
+
+    if (!allSame)
+        debug(msg +  &quot;The array did not have all the expected elements, first array: &quot; + array1 + &quot; second array: &quot; + array2);
+    return allSame;
+
+}
+
+function testConstructorFunction(name, args, expected) {
+    function foo(array, constructor) {
+        if (!hasSameValues(constructor + &quot;.&quot; + name + &quot; did not produce the correct result on &quot; + name + args, array, expected))
+            return false
+        return true;
+    }
+
+    return forEachTypedArray(typedArrays, foo, name, args);
+}
+
+function testConstructor(args, expected) {
+    function foo(array, constructor) {
+        if (!hasSameValues(constructor + args + &quot; did not produce the correct result&quot;, array, expected))
+            return false
+        return true;
+    }
+
+    return forEachTypedArray(typedArrays, foo, &quot;&quot;, args);
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayconstructorjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/typedarray-constructor.js (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-constructor.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-constructor.js        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,66 @@
</span><ins>+load(&quot;./resources/typedarray-constructor-helper-functions.js&quot;);
+
+let TypedArray = Object.getPrototypeOf(Int32Array);
+
+class A extends TypedArray {
+    constructor() { super(); }
+
+}
+
+shouldThrow(&quot;new A()&quot;);
+
+let foo = [1,2,3,4];
+
+function iterator() {
+    return { i: 0,
+             next: function() {
+                 if (this.i &lt; foo.length/2) {
+                     return { done: false,
+                              value: foo[this.i++]
+                            };
+                 }
+                 return { done: true };
+             }
+           };
+}
+
+foo[Symbol.iterator] = iterator;
+
+shouldBeTrue(&quot;testConstructor('(foo)', [1,2])&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;Test that we don't premptively convert to native values and use a gc-safe temporary storage.&quot;);
+
+
+done = false;
+obj = {
+    valueOf: function() {
+        if (!done)
+            throw &quot;bad&quot;;
+        return 1;
+    }
+};
+
+foo = [obj, 2, 3, 4];
+
+function iterator2() {
+    done = false;
+    return { i: 0,
+             next: function() {
+                 gc();
+                 if (this.i &lt; foo.length/2) {
+                     return { done: false,
+                              value: foo[this.i++]
+                            };
+                 }
+                 done = true;
+                 return { done: true };
+             }
+           };
+}
+
+foo[Symbol.iterator] = iterator2;
+
+shouldBeTrue(&quot;testConstructor('(foo)', [1,2])&quot;);
+
+finishJSTest();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayfromjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/typedarray-from.js (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-from.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-from.js        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+load(&quot;./resources/typedarray-constructor-helper-functions.js&quot;);
+description(
+&quot;This test checks the behavior of the TypedArray.from function&quot;
+);
+
+shouldBe(&quot;Int32Array.from.length&quot;, &quot;1&quot;);
+shouldBe(&quot;Int32Array.from.name&quot;, &quot;'from'&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;testConstructorFunction has the following arg list (name, args, init, result [ , expectedArray ])&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;1.0 Single Argument Testing&quot;);
+shouldBeTrue(&quot;testConstructorFunction('from', '([])', [])&quot;);
+shouldBeTrue(&quot;testConstructorFunction('from', '([2])', [2])&quot;);
+shouldBeTrue(&quot;testConstructorFunction('from', '([2,3,4])', [2,3,4])&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;2.0 Two Argument Testing&quot;);
+function even(e, i) {
+    return !(e &amp; 1) || (this.change ? this.change.indexOf(i) &gt;= 0 : false);
+}
+shouldBeTrue(&quot;testConstructorFunction('from', '([12, 5, 8, 13, 44], even)', [1, 0, 1, 0, 1])&quot;);
+shouldBeTrue(&quot;testConstructorFunction('from', '([11, 54, 18, 13, 1], even)', [0, 1, 1, 0, 0])&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;3.0 Three Argument Testing&quot;);
+var thisValue = { change: [1, 3] };
+shouldBeTrue(&quot;testConstructorFunction('from', '([12, 23, 11, 1, 45], even, thisValue)', [1, 1, 0, 1, 0])&quot;);
+debug(&quot;&quot;);
+
+
+debug(&quot;4.0 Exception Test&quot;);
+function isBigEnoughAndException(element, index, array) {
+    if(index==1) throw &quot;exception from function&quot;;
+    return (element &gt;= 10);
+}
+shouldThrow(&quot;testConstructorFunction('from', '([12, 15, 10, 13, 44], isBigEnoughAndException)', false)&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;5.0 Wrong Type for Callback Test&quot;);
+shouldThrow(&quot;testConstructorFunction('from', '( [12, 15, 10, 13, 44], 8)', false)&quot;);
+shouldThrow(&quot;testConstructorFunction('from', '([12, 15, 10, 13, 44], \&quot;wrong\&quot;)', false)&quot;);
+shouldThrow(&quot;testConstructorFunction('from', '([12, 15, 10, 13, 44], new Object())', false)&quot;);
+shouldThrow(&quot;testConstructorFunction('from', '([12, 15, 10, 13, 44], null)', false)&quot;);
+debug(&quot;&quot;);
+finishJSTest();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayofjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/typedarray-of.js (0 => 191059)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-of.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-of.js        2015-10-14 19:07:12 UTC (rev 191059)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+load(&quot;./resources/typedarray-constructor-helper-functions.js&quot;);
+description(
+&quot;This test checks the behavior of the TypedArray.of function&quot;
+);
+
+shouldBe(&quot;Int32Array.of.length&quot;, &quot;0&quot;);
+shouldBe(&quot;Int32Array.of.name&quot;, &quot;'of'&quot;);
+debug(&quot;&quot;);
+
+debug(&quot;testPrototypeFunction has the following arg list (name, args, expected)&quot;);
+debug(&quot;&quot;);
+
+shouldBeTrue(&quot;testConstructorFunction('of', '()', [])&quot;);
+shouldBeTrue(&quot;testConstructorFunction('of', '(1)', [1])&quot;);
+shouldBeTrue(&quot;testConstructorFunction('of', '(1,2,3)', [1,2,3])&quot;);
+finishJSTest();
</ins></span></pre>
</div>
</div>

</body>
</html>