<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[198435] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/198435">198435</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-03-18 11:42:53 -0700 (Fri, 18 Mar 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>DataView should use an accessor for its length and buffer properties
https://bugs.webkit.org/show_bug.cgi?id=155625

Reviewed by Michael Saboff.

The DataView object should use an accessor on DataView.prototype for its
byteLength, byteOffset, and buffer properties. This patch also, moves the
buffer property off the TypedArray object itself and onto the prototype
along with the other accessors. Since the .buffer property is no longer on
the object, JSArrayBufferView no longer needs to intercept accesses to
properties. Finally, this patch also fixes the length property on all the
existing DataView.prototype functions.

* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::getOwnPropertySlot): Deleted.
(JSC::JSArrayBufferView::put): Deleted.
(JSC::JSArrayBufferView::defineOwnProperty): Deleted.
(JSC::JSArrayBufferView::deleteProperty): Deleted.
(JSC::JSArrayBufferView::getOwnNonIndexPropertyNames): Deleted.
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::jsBuffer):
* runtime/JSDataViewPrototype.cpp:
(JSC::dataViewProtoGetterBuffer):
(JSC::dataViewProtoGetterByteLength):
(JSC::dataViewProtoGetterByteOffset):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoGetterFuncBuffer):
* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::typedArrayViewProtoGetterFuncBuffer):
(JSC::JSTypedArrayViewPrototype::finishCreation):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressdataviewprototypeaccessorsjs">trunk/Source/JavaScriptCore/tests/stress/dataview-prototype-accessors.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -1,3 +1,36 @@
</span><ins>+2016-03-18  Keith Miller  &lt;keith_miller@apple.com&gt;
+
+        DataView should use an accessor for its length and buffer properties
+        https://bugs.webkit.org/show_bug.cgi?id=155625
+
+        Reviewed by Michael Saboff.
+
+        The DataView object should use an accessor on DataView.prototype for its
+        byteLength, byteOffset, and buffer properties. This patch also, moves the
+        buffer property off the TypedArray object itself and onto the prototype
+        along with the other accessors. Since the .buffer property is no longer on
+        the object, JSArrayBufferView no longer needs to intercept accesses to
+        properties. Finally, this patch also fixes the length property on all the
+        existing DataView.prototype functions.
+
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::getOwnPropertySlot): Deleted.
+        (JSC::JSArrayBufferView::put): Deleted.
+        (JSC::JSArrayBufferView::defineOwnProperty): Deleted.
+        (JSC::JSArrayBufferView::deleteProperty): Deleted.
+        (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames): Deleted.
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::jsBuffer):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::dataViewProtoGetterBuffer):
+        (JSC::dataViewProtoGetterByteLength):
+        (JSC::dataViewProtoGetterByteOffset):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoGetterFuncBuffer):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+
</ins><span class="cx"> 2016-03-18  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed speculative cloop buildfix after r198364.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -136,21 +136,6 @@
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSArrayBufferView::getOwnPropertySlot(
-    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(object);
-    
-    if (propertyName == exec-&gt;propertyNames().buffer) {
-        slot.setValue(
-            thisObject, DontDelete | ReadOnly, exec-&gt;vm().m_typedArrayController-&gt;toJS(
-                exec, thisObject-&gt;globalObject(), thisObject-&gt;buffer()));
-        return true;
-    }
-    
-    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
-}
-
</del><span class="cx"> void JSArrayBufferView::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><span class="cx">     JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(cell);
</span><span class="lines">@@ -172,46 +157,10 @@
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
</span><span class="cx">         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
</span><del>-
-    if (propertyName == exec-&gt;propertyNames().buffer)
-        return reject(exec, slot.isStrictMode(), &quot;Attempting to write to read-only typed array property.&quot;);
</del><span class="cx">     
</span><span class="cx">     return Base::put(thisObject, exec, propertyName, value, slot);
</span><span class="cx"> }
</span><del>-
-bool JSArrayBufferView::defineOwnProperty(
-    JSObject* object, ExecState* exec, PropertyName propertyName,
-    const PropertyDescriptor&amp; descriptor, bool shouldThrow)
-{
-    JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(object);
-    if (propertyName == exec-&gt;propertyNames().buffer)
-        return reject(exec, shouldThrow, &quot;Attempting to define read-only typed array property.&quot;);
</del><span class="cx">     
</span><del>-    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
-}
-
-bool JSArrayBufferView::deleteProperty(
-    JSCell* cell, ExecState* exec, PropertyName propertyName)
-{
-    JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(cell);
-    if (propertyName == exec-&gt;propertyNames().buffer)
-        return false;
-    
-    return Base::deleteProperty(thisObject, exec, propertyName);
-}
-
-void JSArrayBufferView::getOwnNonIndexPropertyNames(
-    JSObject* object, ExecState* exec, PropertyNameArray&amp; array, EnumerationMode mode)
-{
-    JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(object);
-    
-    if (mode.includeDontEnumProperties())
-        array.add(exec-&gt;propertyNames().buffer);
-
-    
-    Base::getOwnNonIndexPropertyNames(thisObject, exec, array, mode);
-}
-
</del><span class="cx"> void JSArrayBufferView::finalize(JSCell* cell)
</span><span class="cx"> {
</span><span class="cx">     JSArrayBufferView* thisObject = static_cast&lt;JSArrayBufferView*&gt;(cell);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -93,8 +93,6 @@
</span><span class="cx"> class JSArrayBufferView : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames | OverridesGetOwnPropertySlot;
-    
</del><span class="cx">     static const unsigned fastSizeLimit = 1000;
</span><span class="cx">     
</span><span class="cx">     static size_t sizeOf(uint32_t length, uint32_t elementSize)
</span><span class="lines">@@ -146,20 +144,16 @@
</span><span class="cx">     JS_EXPORT_PRIVATE JSArrayBufferView(VM&amp;, ConstructionContext&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE void finishCreation(VM&amp;);
</span><span class="cx">     
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx">     static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);
</span><del>-    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&amp;, bool shouldThrow);
-    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
</del><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx">     
</span><del>-    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
-    
</del><span class="cx"> public:
</span><span class="cx">     TypedArrayMode mode() const { return m_mode; }
</span><span class="cx">     bool hasArrayBuffer() const { return JSC::hasArrayBuffer(mode()); }
</span><span class="cx">     
</span><span class="cx">     ArrayBuffer* buffer();
</span><ins>+    JSArrayBuffer* jsBuffer(ExecState* exec) { return exec-&gt;vm().m_typedArrayController-&gt;toJS(exec, globalObject(), buffer()); }
</ins><span class="cx">     PassRefPtr&lt;ArrayBufferView&gt; impl();
</span><span class="cx">     bool isNeutered() { return hasArrayBuffer() &amp;&amp; !vector(); }
</span><span class="cx">     void neuter();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> #include &quot;JSDataViewPrototype.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #include &quot;Error.h&quot;
</span><ins>+#include &quot;JSArrayBuffer.h&quot;
</ins><span class="cx"> #include &quot;JSDataView.h&quot;
</span><span class="cx"> #include &quot;Lookup.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="lines">@@ -38,22 +39,25 @@
</span><span class="cx"> 
</span><span class="cx"> /* Source for JSDataViewPrototype.lut.h
</span><span class="cx"> @begin dataViewTable
</span><del>-  getInt8               dataViewProtoFuncGetInt8             DontEnum|Function       0
-  getUint8              dataViewProtoFuncGetUint8            DontEnum|Function       0
-  getInt16              dataViewProtoFuncGetInt16            DontEnum|Function       0
-  getUint16             dataViewProtoFuncGetUint16           DontEnum|Function       0
-  getInt32              dataViewProtoFuncGetInt32            DontEnum|Function       0
-  getUint32             dataViewProtoFuncGetUint32           DontEnum|Function       0
-  getFloat32            dataViewProtoFuncGetFloat32          DontEnum|Function       0
-  getFloat64            dataViewProtoFuncGetFloat64          DontEnum|Function       0
-  setInt8               dataViewProtoFuncSetInt8             DontEnum|Function       0
-  setUint8              dataViewProtoFuncSetUint8            DontEnum|Function       0
-  setInt16              dataViewProtoFuncSetInt16            DontEnum|Function       0
-  setUint16             dataViewProtoFuncSetUint16           DontEnum|Function       0
-  setInt32              dataViewProtoFuncSetInt32            DontEnum|Function       0
-  setUint32             dataViewProtoFuncSetUint32           DontEnum|Function       0
-  setFloat32            dataViewProtoFuncSetFloat32          DontEnum|Function       0
-  setFloat64            dataViewProtoFuncSetFloat64          DontEnum|Function       0
</del><ins>+  getInt8               dataViewProtoFuncGetInt8             DontEnum|Function       1
+  getUint8              dataViewProtoFuncGetUint8            DontEnum|Function       1
+  getInt16              dataViewProtoFuncGetInt16            DontEnum|Function       1
+  getUint16             dataViewProtoFuncGetUint16           DontEnum|Function       1
+  getInt32              dataViewProtoFuncGetInt32            DontEnum|Function       1
+  getUint32             dataViewProtoFuncGetUint32           DontEnum|Function       1
+  getFloat32            dataViewProtoFuncGetFloat32          DontEnum|Function       1
+  getFloat64            dataViewProtoFuncGetFloat64          DontEnum|Function       1
+  setInt8               dataViewProtoFuncSetInt8             DontEnum|Function       2
+  setUint8              dataViewProtoFuncSetUint8            DontEnum|Function       2
+  setInt16              dataViewProtoFuncSetInt16            DontEnum|Function       2
+  setUint16             dataViewProtoFuncSetUint16           DontEnum|Function       2
+  setInt32              dataViewProtoFuncSetInt32            DontEnum|Function       2
+  setUint32             dataViewProtoFuncSetUint32           DontEnum|Function       2
+  setFloat32            dataViewProtoFuncSetFloat32          DontEnum|Function       2
+  setFloat64            dataViewProtoFuncSetFloat64          DontEnum|Function       2
+  buffer                dataViewProtoGetterBuffer            DontEnum|Accessor       0
+  byteLength            dataViewProtoGetterByteLength        DontEnum|Accessor       0
+  byteOffset            dataViewProtoGetterByteOffset        DontEnum|Accessor       0
</ins><span class="cx"> @end
</span><span class="cx"> */
</span><span class="cx"> 
</span><span class="lines">@@ -73,6 +77,9 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint32(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat32(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat64(ExecState*);
</span><ins>+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState*);
</ins><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -219,6 +226,33 @@
</span><span class="cx"> #pragma clang diagnostic ignored &quot;-Wmissing-prototypes&quot;
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState* exec)
+{
+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
+    if (!view)
+        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
+
+    return JSValue::encode(view-&gt;jsBuffer(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState* exec)
+{
+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
+    if (!view)
+        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
+
+    return JSValue::encode(jsNumber(view-&gt;length()));
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState* exec)
+{
+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
+    if (!view)
+        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
+
+    return JSValue::encode(jsNumber(view-&gt;byteOffset()));
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt8(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     return getData&lt;Int8Adaptor&gt;(exec);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -320,6 +320,15 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(ExecState* exec)
+{
+    // 22.2.3.3
+    ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
+
+    return JSValue::encode(thisObject-&gt;jsBuffer(exec));
+}
+
+template&lt;typename ViewClass&gt;
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     // 22.2.3.17
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp (198434 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2016-03-18 18:37:12 UTC (rev 198434)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -152,6 +152,14 @@
</span><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncKeys);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncBuffer(ExecState* exec)
+{
+    JSValue thisValue = exec-&gt;thisValue();
+    if (!thisValue.isObject())
+        return throwVMError(exec, createTypeError(exec, &quot;Receiver should be a typed array view but was not an object&quot;));
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncBuffer);
+}
+
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncLength(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="lines">@@ -255,6 +263,7 @@
</span><span class="cx"> 
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> 
</span><ins>+    JSC_NATIVE_GETTER(vm.propertyNames-&gt;buffer, typedArrayViewProtoGetterFuncBuffer, DontEnum | ReadOnly | DontDelete);
</ins><span class="cx">     JSC_NATIVE_INTRINSIC_GETTER(vm.propertyNames-&gt;byteLength, typedArrayViewProtoGetterFuncByteLength, DontEnum | ReadOnly | DontDelete, TypedArrayByteLengthIntrinsic);
</span><span class="cx">     JSC_NATIVE_INTRINSIC_GETTER(vm.propertyNames-&gt;byteOffset, typedArrayViewProtoGetterFuncByteOffset, DontEnum | ReadOnly | DontDelete, TypedArrayByteOffsetIntrinsic);
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;copyWithin&quot;, typedArrayViewProtoFuncCopyWithin, DontEnum, 2);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressdataviewprototypeaccessorsjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/dataview-prototype-accessors.js (0 => 198435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/dataview-prototype-accessors.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/dataview-prototype-accessors.js        2016-03-18 18:42:53 UTC (rev 198435)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+{
+    let buffer = new ArrayBuffer(10);
+    let view = new DataView(buffer);
+
+    if (view.byteOffset !== 0)
+        throw &quot;byteoffest should be 0&quot;;
+
+    if (view.byteLength !== 10)
+        throw &quot;byteLength should be 0&quot;
+
+    if (view.buffer !== buffer)
+        throw &quot;buffer should be the incomming buffer&quot;
+
+    view = new DataView(buffer, 1, 1)
+
+    if (view.byteOffset !== 1)
+        throw &quot;byteoffest should be 0&quot;;
+
+    if (view.byteLength !== 1)
+        throw &quot;byteLength should be 0&quot;
+
+    if (view.buffer !== buffer)
+        throw &quot;buffer should be the incomming buffer&quot;
+}
</ins></span></pre>
</div>
</div>

</body>
</html>