<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212535] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212535">212535</a></dd>
<dt>Author</dt> <dd>utatane.tea@gmail.com</dd>
<dt>Date</dt> <dd>2017-02-16 22:04:16 -0800 (Thu, 16 Feb 2017)</dd>
</dl>

<h3>Log Message</h3>
<pre>[JSC] Drop PassRefPtr from ArrayBuffer
https://bugs.webkit.org/show_bug.cgi?id=168455

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This patch finally drops all the PassRefPtr in JSC.
We changed PassRefPtr&lt;ArrayBuffer&gt; to RefPtr&lt;ArrayBuffer&gt;&amp;&amp;.
Since ArrayBuffer may be nullptr if the array is neutered,
we hold it as RefPtr&lt;&gt; instead of Ref&lt;&gt;.

And we also drops 2 files, TypedArrayBase.h and IntegralTypedArrayBase.h.
They are not used (and they are not referenced from the project file).

* inspector/JavaScriptCallFrame.h:
* jsc.cpp:
(functionDollarAgentReceiveBroadcast):
* runtime/ArrayBufferView.cpp:
(JSC::ArrayBufferView::ArrayBufferView):
* runtime/ArrayBufferView.h:
(JSC::ArrayBufferView::possiblySharedBuffer):
(JSC::ArrayBufferView::unsharedBuffer):
(JSC::ArrayBufferView::verifySubRangeLength):
(JSC::ArrayBufferView::clampOffsetAndNumElements):
* runtime/ClassInfo.h:
* runtime/DataView.cpp:
(JSC::DataView::DataView):
(JSC::DataView::create):
* runtime/DataView.h:
* runtime/GenericTypedArrayView.h:
* runtime/GenericTypedArrayViewInlines.h:
(JSC::GenericTypedArrayView&lt;Adaptor&gt;::GenericTypedArrayView):
(JSC::GenericTypedArrayView&lt;Adaptor&gt;::create):
(JSC::GenericTypedArrayView&lt;Adaptor&gt;::subarray):
* runtime/IntegralTypedArrayBase.h: Removed.
* runtime/JSArrayBuffer.cpp:
(JSC::JSArrayBuffer::JSArrayBuffer):
(JSC::JSArrayBuffer::create):
* runtime/JSArrayBuffer.h:
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
* runtime/JSArrayBufferView.h:
* runtime/JSArrayBufferViewInlines.h:
(JSC::JSArrayBufferView::possiblySharedImpl):
(JSC::JSArrayBufferView::unsharedImpl):
* runtime/JSCell.cpp:
(JSC::JSCell::slowDownAndWasteMemory):
(JSC::JSCell::getTypedArrayImpl):
* runtime/JSCell.h:
* runtime/JSDataView.cpp:
(JSC::JSDataView::create):
(JSC::JSDataView::possiblySharedTypedImpl):
(JSC::JSDataView::unsharedTypedImpl):
(JSC::JSDataView::getTypedArrayImpl):
* runtime/JSDataView.h:
* runtime/JSGenericTypedArrayView.h:
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewWithArguments):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::create):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::possiblySharedTypedImpl):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::unsharedTypedImpl):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::getTypedArrayImpl):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* runtime/JSTypedArrays.cpp:
(JSC::createUint8TypedArray):
* runtime/TypedArrayBase.h: Removed.

Source/WebCore:

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::readArrayBufferView):
* css/FontFace.cpp:
(WebCore::FontFace::create):
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
(WebCore::MediaPlayerPrivateAVFoundation::extractKeyURIKeyIDAndCertificateFromInitData):
* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::shouldWaitForLoadingOfResource):
* platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
(WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorJavaScriptCallFrameh">trunk/Source/JavaScriptCore/inspector/JavaScriptCallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferViewcpp">trunk/Source/JavaScriptCore/runtime/ArrayBufferView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferViewh">trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClassInfoh">trunk/Source/JavaScriptCore/runtime/ClassInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDataViewcpp">trunk/Source/JavaScriptCore/runtime/DataView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDataViewh">trunk/Source/JavaScriptCore/runtime/DataView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGenericTypedArrayViewh">trunk/Source/JavaScriptCore/runtime/GenericTypedArrayView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGenericTypedArrayViewInlinesh">trunk/Source/JavaScriptCore/runtime/GenericTypedArrayViewInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBuffercpp">trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferh">trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewcpp">trunk/Source/JavaScriptCore/runtime/JSDataView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewh">trunk/Source/JavaScriptCore/runtime/JSDataView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayscpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrays.cpp</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsSerializedScriptValuecpp">trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp</a></li>
<li><a href="#trunkSourceWebCorecssFontFacecpp">trunk/Source/WebCore/css/FontFace.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsavfoundationMediaPlayerPrivateAVFoundationcpp">trunk/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsavfoundationcfMediaPlayerPrivateAVFoundationCFcpp">trunk/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsavfoundationobjcCDMSessionAVFoundationObjCmm">trunk/Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsavfoundationobjcMediaPlayerPrivateAVFoundationObjCmm">trunk/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntegralTypedArrayBaseh">trunk/Source/JavaScriptCore/runtime/IntegralTypedArrayBase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypedArrayBaseh">trunk/Source/JavaScriptCore/runtime/TypedArrayBase.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/ChangeLog        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1,3 +1,75 @@
</span><ins>+2017-02-16  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [JSC] Drop PassRefPtr from ArrayBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=168455
+
+        Reviewed by Geoffrey Garen.
+
+        This patch finally drops all the PassRefPtr in JSC.
+        We changed PassRefPtr&lt;ArrayBuffer&gt; to RefPtr&lt;ArrayBuffer&gt;&amp;&amp;.
+        Since ArrayBuffer may be nullptr if the array is neutered,
+        we hold it as RefPtr&lt;&gt; instead of Ref&lt;&gt;.
+
+        And we also drops 2 files, TypedArrayBase.h and IntegralTypedArrayBase.h.
+        They are not used (and they are not referenced from the project file).
+
+        * inspector/JavaScriptCallFrame.h:
+        * jsc.cpp:
+        (functionDollarAgentReceiveBroadcast):
+        * runtime/ArrayBufferView.cpp:
+        (JSC::ArrayBufferView::ArrayBufferView):
+        * runtime/ArrayBufferView.h:
+        (JSC::ArrayBufferView::possiblySharedBuffer):
+        (JSC::ArrayBufferView::unsharedBuffer):
+        (JSC::ArrayBufferView::verifySubRangeLength):
+        (JSC::ArrayBufferView::clampOffsetAndNumElements):
+        * runtime/ClassInfo.h:
+        * runtime/DataView.cpp:
+        (JSC::DataView::DataView):
+        (JSC::DataView::create):
+        * runtime/DataView.h:
+        * runtime/GenericTypedArrayView.h:
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView&lt;Adaptor&gt;::GenericTypedArrayView):
+        (JSC::GenericTypedArrayView&lt;Adaptor&gt;::create):
+        (JSC::GenericTypedArrayView&lt;Adaptor&gt;::subarray):
+        * runtime/IntegralTypedArrayBase.h: Removed.
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::JSArrayBuffer):
+        (JSC::JSArrayBuffer::create):
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::possiblySharedImpl):
+        (JSC::JSArrayBufferView::unsharedImpl):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::slowDownAndWasteMemory):
+        (JSC::JSCell::getTypedArrayImpl):
+        * runtime/JSCell.h:
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::create):
+        (JSC::JSDataView::possiblySharedTypedImpl):
+        (JSC::JSDataView::unsharedTypedImpl):
+        (JSC::JSDataView::getTypedArrayImpl):
+        * runtime/JSDataView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::create):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::possiblySharedTypedImpl):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::unsharedTypedImpl):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::getTypedArrayImpl):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSTypedArrays.cpp:
+        (JSC::createUint8TypedArray):
+        * runtime/TypedArrayBase.h: Removed.
+
</ins><span class="cx"> 2017-02-16  Keith Miller  &lt;keith_miller@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         ASSERTION FAILED: vm.heap.mutatorState() == MutatorState::Running || vm.apiLock().ownerThread() != std::this_thread::get_id()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorJavaScriptCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JavaScriptCallFrame.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/JavaScriptCallFrame.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/inspector/JavaScriptCallFrame.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -29,7 +29,6 @@
</span><span class="cx"> #include &quot;debugger/DebuggerCallFrame.h&quot;
</span><span class="cx"> #include &quot;interpreter/CallFrame.h&quot;
</span><span class="cx"> #include &lt;wtf/Forward.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/RefCounted.h&gt;
</span><span class="cx"> #include &lt;wtf/text/TextPosition.h&gt;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -2553,7 +2553,8 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     RefPtr&lt;ArrayBuffer&gt; nativeBuffer = ArrayBuffer::create(message-&gt;releaseContents());
</span><del>-    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(vm, exec-&gt;lexicalGlobalObject()-&gt;arrayBufferStructure(nativeBuffer-&gt;sharingMode()), nativeBuffer);
</del><ins>+    ArrayBufferSharingMode sharingMode = nativeBuffer-&gt;sharingMode();
+    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(vm, exec-&gt;lexicalGlobalObject()-&gt;arrayBufferStructure(sharingMode), WTFMove(nativeBuffer));
</ins><span class="cx">     
</span><span class="cx">     MarkedArgumentBuffer args;
</span><span class="cx">     args.append(jsBuffer);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBufferView.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBufferView.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/ArrayBufferView.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -29,11 +29,11 @@
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> ArrayBufferView::ArrayBufferView(
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; buffer,
</del><ins>+    RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer,
</ins><span class="cx">     unsigned byteOffset)
</span><span class="cx">         : m_byteOffset(byteOffset)
</span><span class="cx">         , m_isNeuterable(true)
</span><del>-        , m_buffer(buffer)
</del><ins>+        , m_buffer(WTFMove(buffer))
</ins><span class="cx"> {
</span><span class="cx">     m_baseAddress = m_buffer ? (static_cast&lt;char*&gt;(m_buffer-&gt;data()) + m_byteOffset) : 0;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayBufferViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -29,7 +29,6 @@
</span><span class="cx"> #include &quot;TypedArrayType.h&quot;
</span><span class="cx"> #include &lt;algorithm&gt;
</span><span class="cx"> #include &lt;limits.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/RefCounted.h&gt;
</span><span class="cx"> #include &lt;wtf/RefPtr.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -48,16 +47,16 @@
</span><span class="cx">         return !m_buffer || m_buffer-&gt;isNeutered();
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; possiblySharedBuffer() const
</del><ins>+    RefPtr&lt;ArrayBuffer&gt; possiblySharedBuffer() const
</ins><span class="cx">     {
</span><span class="cx">         if (isNeutered())
</span><del>-            return 0;
</del><ins>+            return nullptr;
</ins><span class="cx">         return m_buffer;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; unsharedBuffer() const
</del><ins>+    RefPtr&lt;ArrayBuffer&gt; unsharedBuffer() const
</ins><span class="cx">     {
</span><del>-        PassRefPtr&lt;ArrayBuffer&gt; result = possiblySharedBuffer();
</del><ins>+        RefPtr&lt;ArrayBuffer&gt; result = possiblySharedBuffer();
</ins><span class="cx">         RELEASE_ASSERT(!result-&gt;isShared());
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="lines">@@ -100,9 +99,9 @@
</span><span class="cx"> 
</span><span class="cx">     // Helper to verify that a given sub-range of an ArrayBuffer is
</span><span class="cx">     // within range.
</span><del>-    static bool verifySubRangeLength(PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned numElements, size_t size)
</del><ins>+    static bool verifySubRangeLength(const ArrayBuffer&amp; buffer, unsigned byteOffset, unsigned numElements, size_t size)
</ins><span class="cx">     {
</span><del>-        unsigned byteLength = buffer-&gt;byteLength();
</del><ins>+        unsigned byteLength = buffer.byteLength();
</ins><span class="cx">         if (byteOffset &gt; byteLength)
</span><span class="cx">             return false;
</span><span class="cx">         unsigned remainingElements = (byteLength - byteOffset) / size;
</span><span class="lines">@@ -114,7 +113,7 @@
</span><span class="cx">     virtual JSArrayBufferView* wrap(ExecState*, JSGlobalObject*) = 0;
</span><span class="cx">     
</span><span class="cx"> protected:
</span><del>-    JS_EXPORT_PRIVATE ArrayBufferView(PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset);
</del><ins>+    JS_EXPORT_PRIVATE ArrayBufferView(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset);
</ins><span class="cx"> 
</span><span class="cx">     inline bool setImpl(ArrayBufferView*, unsigned byteOffset);
</span><span class="cx"> 
</span><span class="lines">@@ -130,7 +129,7 @@
</span><span class="cx">     // output offset is in number of bytes from the underlying buffer's view.
</span><span class="cx">     template &lt;typename T&gt;
</span><span class="cx">     static void clampOffsetAndNumElements(
</span><del>-        PassRefPtr&lt;ArrayBuffer&gt; buffer,
</del><ins>+        const ArrayBuffer&amp; buffer,
</ins><span class="cx">         unsigned arrayByteOffset,
</span><span class="cx">         unsigned *offset,
</span><span class="cx">         unsigned *numElements)
</span><span class="lines">@@ -137,13 +136,13 @@
</span><span class="cx">     {
</span><span class="cx">         unsigned maxOffset = (UINT_MAX - arrayByteOffset) / sizeof(T);
</span><span class="cx">         if (*offset &gt; maxOffset) {
</span><del>-            *offset = buffer-&gt;byteLength();
</del><ins>+            *offset = buffer.byteLength();
</ins><span class="cx">             *numElements = 0;
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         *offset = arrayByteOffset + *offset * sizeof(T);
</span><del>-        *offset = std::min(buffer-&gt;byteLength(), *offset);
-        unsigned remainingElements = (buffer-&gt;byteLength() - *offset) / sizeof(T);
</del><ins>+        *offset = std::min(buffer.byteLength(), *offset);
+        unsigned remainingElements = (buffer.byteLength() - *offset) / sizeof(T);
</ins><span class="cx">         *numElements = std::min(remainingElements, *numElements);
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClassInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClassInfo.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx">     typedef ArrayBuffer* (*SlowDownAndWasteMemory)(JSArrayBufferView*);
</span><span class="cx">     SlowDownAndWasteMemory slowDownAndWasteMemory;
</span><span class="cx">     
</span><del>-    typedef PassRefPtr&lt;ArrayBufferView&gt; (*GetTypedArrayImpl)(JSArrayBufferView*);
</del><ins>+    typedef RefPtr&lt;ArrayBufferView&gt; (*GetTypedArrayImpl)(JSArrayBufferView*);
</ins><span class="cx">     GetTypedArrayImpl getTypedArrayImpl;
</span><span class="cx"> 
</span><span class="cx">     typedef bool (*PreventExtensionsFunctionPtr)(JSObject*, ExecState*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDataViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DataView.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DataView.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/DataView.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -32,22 +32,22 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-DataView::DataView(PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned byteLength)
-    : ArrayBufferView(buffer, byteOffset)
</del><ins>+DataView::DataView(RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, unsigned byteOffset, unsigned byteLength)
+    : ArrayBufferView(WTFMove(buffer), byteOffset)
</ins><span class="cx">     , m_byteLength(byteLength)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;DataView&gt; DataView::create(
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned byteLength)
</del><ins>+    RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, unsigned byteOffset, unsigned byteLength)
</ins><span class="cx"> {
</span><del>-    return adoptRef(*new DataView(buffer, byteOffset, byteLength));
</del><ins>+    return adoptRef(*new DataView(WTFMove(buffer), byteOffset, byteLength));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Ref&lt;DataView&gt; DataView::create(PassRefPtr&lt;ArrayBuffer&gt; passedBuffer)
</del><ins>+Ref&lt;DataView&gt; DataView::create(RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
-    return create(buffer, 0, buffer-&gt;byteLength());
</del><ins>+    unsigned byteLength = buffer-&gt;byteLength();
+    return create(WTFMove(buffer), 0, byteLength);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSArrayBufferView* DataView::wrap(ExecState* exec, JSGlobalObject* globalObject)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDataViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DataView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DataView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/DataView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -27,17 +27,16 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;ArrayBufferView.h&quot;
</span><span class="cx"> #include &lt;wtf/FlipBytes.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> class DataView : public ArrayBufferView {
</span><span class="cx"> protected:
</span><del>-    DataView(PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset, unsigned byteLength);
</del><ins>+    DataView(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset, unsigned byteLength);
</ins><span class="cx">     
</span><span class="cx"> public:
</span><del>-    JS_EXPORT_PRIVATE static Ref&lt;DataView&gt; create(PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset, unsigned length);
-    static Ref&lt;DataView&gt; create(PassRefPtr&lt;ArrayBuffer&gt;);
</del><ins>+    JS_EXPORT_PRIVATE static Ref&lt;DataView&gt; create(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset, unsigned length);
+    static Ref&lt;DataView&gt; create(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;);
</ins><span class="cx">     
</span><span class="cx">     unsigned byteLength() const override
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GenericTypedArrayView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GenericTypedArrayView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/GenericTypedArrayView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -33,12 +33,12 @@
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> class GenericTypedArrayView : public ArrayBufferView {
</span><span class="cx"> protected:
</span><del>-    GenericTypedArrayView(PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset, unsigned length);
</del><ins>+    GenericTypedArrayView(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset, unsigned length);
</ins><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     static RefPtr&lt;GenericTypedArrayView&gt; create(unsigned length);
</span><span class="cx">     static RefPtr&lt;GenericTypedArrayView&gt; create(const typename Adaptor::Type* array, unsigned length);
</span><del>-    static RefPtr&lt;GenericTypedArrayView&gt; create(PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset, unsigned length);
</del><ins>+    static RefPtr&lt;GenericTypedArrayView&gt; create(RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset, unsigned length);
</ins><span class="cx">     
</span><span class="cx">     static RefPtr&lt;GenericTypedArrayView&gt; createUninitialized(unsigned length);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GenericTypedArrayViewInlines.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GenericTypedArrayViewInlines.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/GenericTypedArrayViewInlines.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -32,8 +32,8 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> GenericTypedArrayView&lt;Adaptor&gt;::GenericTypedArrayView(
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned length)
-    : ArrayBufferView(buffer, byteOffset)
</del><ins>+    RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, unsigned byteOffset, unsigned length)
+    : ArrayBufferView(WTFMove(buffer), byteOffset)
</ins><span class="cx">     , m_length(length)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -58,10 +58,10 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> RefPtr&lt;GenericTypedArrayView&lt;Adaptor&gt;&gt; GenericTypedArrayView&lt;Adaptor&gt;::create(
</span><del>-    PassRefPtr&lt;ArrayBuffer&gt; passedBuffer, unsigned byteOffset, unsigned length)
</del><ins>+    RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, unsigned byteOffset, unsigned length)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
-    if (!verifySubRangeLength(buffer, byteOffset, length, sizeof(typename Adaptor::Type))
</del><ins>+    ASSERT(buffer);
+    if (!ArrayBufferView::verifySubRangeLength(*buffer, byteOffset, length, sizeof(typename Adaptor::Type))
</ins><span class="cx">         || !verifyByteOffsetAlignment(byteOffset, sizeof(typename Adaptor::Type))) {
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="lines">@@ -94,7 +94,8 @@
</span><span class="cx">     unsigned offset, length;
</span><span class="cx">     calculateOffsetAndLength(start, end, this-&gt;length(), &amp;offset, &amp;length);
</span><span class="cx">     ArrayBuffer* buffer = possiblySharedBuffer();
</span><del>-    clampOffsetAndNumElements&lt;Adaptor::Type&gt;(buffer, byteOffset(), &amp;offset, &amp;length);
</del><ins>+    ASSERT(buffer);
+    clampOffsetAndNumElements&lt;Adaptor::Type&gt;(*buffer, byteOffset(), &amp;offset, &amp;length);
</ins><span class="cx">     return create(buffer, offset, length);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntegralTypedArrayBaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/IntegralTypedArrayBase.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntegralTypedArrayBase.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/IntegralTypedArrayBase.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1,60 +0,0 @@
</span><del>-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (c) 2010, Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#pragma once
-
-#include &quot;TypedArrayBase.h&quot;
-#include &lt;limits&gt;
-#include &lt;wtf/MathExtras.h&gt;
-
-// Base class for all WebGL&lt;T&gt;Array types holding integral
-// (non-floating-point) values.
-
-namespace JSC {
-
-template &lt;typename T&gt;
-class IntegralTypedArrayBase : public TypedArrayBase&lt;T&gt; {
-public:
-    void set(unsigned index, double value)
-    {
-        if (index &gt;= TypedArrayBase&lt;T&gt;::m_length)
-            return;
-        if (std::isnan(value)) // Clamp NaN to 0
-            value = 0;
-        // The double cast is necessary to get the correct wrapping
-        // for out-of-range values with Int32Array and Uint32Array.
-        TypedArrayBase&lt;T&gt;::data()[index] = static_cast&lt;T&gt;(static_cast&lt;int64_t&gt;(value));
-    }
-
-protected:
-    IntegralTypedArrayBase(PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned length)
-        : TypedArrayBase&lt;T&gt;(buffer, byteOffset, length)
-    {
-    }
-
-};
-
-} // namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBuffercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx"> const ClassInfo JSArrayBuffer::s_info = {
</span><span class="cx">     &quot;ArrayBuffer&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSArrayBuffer)};
</span><span class="cx"> 
</span><del>-JSArrayBuffer::JSArrayBuffer(VM&amp; vm, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; arrayBuffer)
</del><ins>+JSArrayBuffer::JSArrayBuffer(VM&amp; vm, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; arrayBuffer)
</ins><span class="cx">     : Base(vm, structure)
</span><span class="cx">     , m_impl(arrayBuffer.get())
</span><span class="cx"> {
</span><span class="lines">@@ -50,12 +50,11 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSArrayBuffer* JSArrayBuffer::create(
</span><del>-    VM&amp; vm, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; passedBuffer)
</del><ins>+    VM&amp; vm, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
</del><span class="cx">     JSArrayBuffer* result =
</span><span class="cx">         new (NotNull, allocateCell&lt;JSArrayBuffer&gt;(vm.heap))
</span><del>-        JSArrayBuffer(vm, structure, buffer);
</del><ins>+        JSArrayBuffer(vm, structure, WTFMove(buffer));
</ins><span class="cx">     result-&gt;finishCreation(vm, structure-&gt;globalObject());
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -36,12 +36,12 @@
</span><span class="cx">     static const unsigned StructureFlags = Base::StructureFlags;
</span><span class="cx">     
</span><span class="cx"> protected:
</span><del>-    JSArrayBuffer(VM&amp;, Structure*, PassRefPtr&lt;ArrayBuffer&gt;);
</del><ins>+    JSArrayBuffer(VM&amp;, Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;);
</ins><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><span class="cx">     
</span><span class="cx"> public:
</span><span class="cx">     // This function will register the new wrapper with the vm's TypedArrayController.
</span><del>-    JS_EXPORT_PRIVATE static JSArrayBuffer* create(VM&amp;, Structure*, PassRefPtr&lt;ArrayBuffer&gt;);
</del><ins>+    JS_EXPORT_PRIVATE static JSArrayBuffer* create(VM&amp;, Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;);
</ins><span class="cx"> 
</span><span class="cx">     ArrayBuffer* impl() const { return m_impl; }
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     
</span><span class="cx">     Structure* structure = callee-&gt;globalObject()-&gt;arrayBufferStructure(newBuffer-&gt;sharingMode());
</span><span class="cx">     
</span><del>-    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, newBuffer);
</del><ins>+    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, WTFMove(newBuffer));
</ins><span class="cx">     
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -103,7 +103,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSArrayBufferView::ConstructionContext::ConstructionContext(
</span><del>-    VM&amp; vm, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; arrayBuffer,
</del><ins>+    VM&amp; vm, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; arrayBuffer,
</ins><span class="cx">     unsigned byteOffset, unsigned length)
</span><span class="cx">     : m_structure(structure)
</span><span class="cx">     , m_length(length)
</span><span class="lines">@@ -116,7 +116,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSArrayBufferView::ConstructionContext::ConstructionContext(
</span><del>-    Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; arrayBuffer,
</del><ins>+    Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; arrayBuffer,
</ins><span class="cx">     unsigned byteOffset, unsigned length, DataViewTag)
</span><span class="cx">     : m_structure(structure)
</span><span class="cx">     , m_length(length)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -122,12 +122,12 @@
</span><span class="cx">         ConstructionContext(Structure*, uint32_t length, void* vector);
</span><span class="cx">         
</span><span class="cx">         JS_EXPORT_PRIVATE ConstructionContext(
</span><del>-            VM&amp;, Structure*, PassRefPtr&lt;ArrayBuffer&gt;,
</del><ins>+            VM&amp;, Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;,
</ins><span class="cx">             unsigned byteOffset, unsigned length);
</span><span class="cx">         
</span><span class="cx">         enum DataViewTag { DataView };
</span><span class="cx">         ConstructionContext(
</span><del>-            Structure*, PassRefPtr&lt;ArrayBuffer&gt;,
</del><ins>+            Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;,
</ins><span class="cx">             unsigned byteOffset, unsigned length, DataViewTag);
</span><span class="cx">         
</span><span class="cx">         bool operator!() const { return !m_structure; }
</span><span class="lines">@@ -162,8 +162,8 @@
</span><span class="cx">     ArrayBuffer* possiblySharedBuffer();
</span><span class="cx">     JSArrayBuffer* unsharedJSBuffer(ExecState* exec);
</span><span class="cx">     JSArrayBuffer* possiblySharedJSBuffer(ExecState* exec);
</span><del>-    PassRefPtr&lt;ArrayBufferView&gt; unsharedImpl();
-    PassRefPtr&lt;ArrayBufferView&gt; possiblySharedImpl();
</del><ins>+    RefPtr&lt;ArrayBufferView&gt; unsharedImpl();
+    RefPtr&lt;ArrayBufferView&gt; possiblySharedImpl();
</ins><span class="cx">     bool isNeutered() { return hasArrayBuffer() &amp;&amp; !vector(); }
</span><span class="cx">     void neuter();
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -61,14 +61,14 @@
</span><span class="cx">     return butterfly()-&gt;indexingHeader()-&gt;arrayBuffer();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline PassRefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::possiblySharedImpl()
</del><ins>+inline RefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::possiblySharedImpl()
</ins><span class="cx"> {
</span><span class="cx">     return methodTable()-&gt;getTypedArrayImpl(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline PassRefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::unsharedImpl()
</del><ins>+inline RefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::unsharedImpl()
</ins><span class="cx"> {
</span><del>-    PassRefPtr&lt;ArrayBufferView&gt; result = possiblySharedImpl();
</del><ins>+    RefPtr&lt;ArrayBufferView&gt; result = possiblySharedImpl();
</ins><span class="cx">     RELEASE_ASSERT(!result-&gt;isShared());
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -250,13 +250,13 @@
</span><span class="cx"> ArrayBuffer* JSCell::slowDownAndWasteMemory(JSArrayBufferView*)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;ArrayBufferView&gt; JSCell::getTypedArrayImpl(JSArrayBufferView*)
</del><ins>+RefPtr&lt;ArrayBufferView&gt; JSCell::getTypedArrayImpl(JSArrayBufferView*)
</ins><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> uint32_t JSCell::getEnumerableLength(ExecState*, JSObject*)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -253,7 +253,7 @@
</span><span class="cx">     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
</span><del>-    JS_EXPORT_PRIVATE static PassRefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</del><ins>+    JS_EXPORT_PRIVATE static RefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     friend class LLIntOffsetsExtractor;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataView.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataView.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSDataView.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -44,14 +44,14 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSDataView* JSDataView::create(
</span><del>-    ExecState* exec, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; passedBuffer,
</del><ins>+    ExecState* exec, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer,
</ins><span class="cx">     unsigned byteOffset, unsigned byteLength)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
-    if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, byteLength, sizeof(uint8_t))) {
</del><ins>+    ASSERT(buffer);
+    if (!ArrayBufferView::verifySubRangeLength(*buffer, byteOffset, byteLength, sizeof(uint8_t))) {
</ins><span class="cx">         throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Length out of range of buffer&quot;)));
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     ConstructionContext context(
</span><del>-        structure, buffer, byteOffset, byteLength, ConstructionContext::DataView);
</del><ins>+        structure, buffer.copyRef(), byteOffset, byteLength, ConstructionContext::DataView);
</ins><span class="cx">     ASSERT(context);
</span><span class="cx">     JSDataView* result =
</span><span class="cx">         new (NotNull, allocateCell&lt;JSDataView&gt;(vm.heap)) JSDataView(vm, context, buffer.get());
</span><span class="lines">@@ -92,12 +92,12 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;DataView&gt; JSDataView::possiblySharedTypedImpl()
</del><ins>+RefPtr&lt;DataView&gt; JSDataView::possiblySharedTypedImpl()
</ins><span class="cx"> {
</span><span class="cx">     return DataView::create(possiblySharedBuffer(), byteOffset(), length());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;DataView&gt; JSDataView::unsharedTypedImpl()
</del><ins>+RefPtr&lt;DataView&gt; JSDataView::unsharedTypedImpl()
</ins><span class="cx"> {
</span><span class="cx">     return DataView::create(unsharedBuffer(), byteOffset(), length());
</span><span class="cx"> }
</span><span class="lines">@@ -183,7 +183,7 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;ArrayBufferView&gt; JSDataView::getTypedArrayImpl(JSArrayBufferView* object)
</del><ins>+RefPtr&lt;ArrayBufferView&gt; JSDataView::getTypedArrayImpl(JSArrayBufferView* object)
</ins><span class="cx"> {
</span><span class="cx">     JSDataView* thisObject = jsCast&lt;JSDataView*&gt;(object);
</span><span class="cx">     return thisObject-&gt;possiblySharedTypedImpl();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSDataView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     
</span><span class="cx"> public:
</span><span class="cx">     JS_EXPORT_PRIVATE static JSDataView* create(
</span><del>-        ExecState*, Structure*, PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset,
</del><ins>+        ExecState*, Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset,
</ins><span class="cx">         unsigned byteLength);
</span><span class="cx">     
</span><span class="cx">     // Dummy methods, which don't actually work; these are just in place to
</span><span class="lines">@@ -57,8 +57,8 @@
</span><span class="cx">         return m_buffer;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PassRefPtr&lt;DataView&gt; possiblySharedTypedImpl();
-    PassRefPtr&lt;DataView&gt; unsharedTypedImpl();
</del><ins>+    RefPtr&lt;DataView&gt; possiblySharedTypedImpl();
+    RefPtr&lt;DataView&gt; unsharedTypedImpl();
</ins><span class="cx">     
</span><span class="cx">     static const TypedArrayType TypedArrayStorageType = TypeDataView;
</span><span class="cx"> 
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx">     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
</span><span class="cx"> 
</span><span class="cx">     static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
</span><del>-    static PassRefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</del><ins>+    static RefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</ins><span class="cx">     
</span><span class="cx"> public:
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -107,9 +107,9 @@
</span><span class="cx">     static JSGenericTypedArrayView* create(ExecState*, Structure*, unsigned length);
</span><span class="cx">     static JSGenericTypedArrayView* createWithFastVector(ExecState*, Structure*, unsigned length, void* vector);
</span><span class="cx">     static JSGenericTypedArrayView* createUninitialized(ExecState*, Structure*, unsigned length);
</span><del>-    static JSGenericTypedArrayView* create(ExecState*, Structure*, PassRefPtr&lt;ArrayBuffer&gt;, unsigned byteOffset, unsigned length);
-    static JSGenericTypedArrayView* create(VM&amp;, Structure*, PassRefPtr&lt;typename Adaptor::ViewType&gt; impl);
-    static JSGenericTypedArrayView* create(Structure*, JSGlobalObject*, PassRefPtr&lt;typename Adaptor::ViewType&gt; impl);
</del><ins>+    static JSGenericTypedArrayView* create(ExecState*, Structure*, RefPtr&lt;ArrayBuffer&gt;&amp;&amp;, unsigned byteOffset, unsigned length);
+    static JSGenericTypedArrayView* create(VM&amp;, Structure*, RefPtr&lt;typename Adaptor::ViewType&gt;&amp;&amp; impl);
+    static JSGenericTypedArrayView* create(Structure*, JSGlobalObject*, RefPtr&lt;typename Adaptor::ViewType&gt;&amp;&amp; impl);
</ins><span class="cx">     
</span><span class="cx">     unsigned byteLength() const { return m_length * sizeof(typename Adaptor::Type); }
</span><span class="cx">     size_t byteSize() const { return sizeOf(m_length, sizeof(typename Adaptor::Type)); }
</span><span class="lines">@@ -225,8 +225,8 @@
</span><span class="cx">     // then it will have thrown an exception.
</span><span class="cx">     bool set(ExecState*, unsigned offset, JSObject*, unsigned objectOffset, unsigned length, CopyType type = CopyType::Unobservable);
</span><span class="cx">     
</span><del>-    PassRefPtr&lt;typename Adaptor::ViewType&gt; possiblySharedTypedImpl();
-    PassRefPtr&lt;typename Adaptor::ViewType&gt; unsharedTypedImpl();
</del><ins>+    RefPtr&lt;typename Adaptor::ViewType&gt; possiblySharedTypedImpl();
+    RefPtr&lt;typename Adaptor::ViewType&gt; unsharedTypedImpl();
</ins><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -291,7 +291,7 @@
</span><span class="cx">     // Allocates the full-on native buffer and moves data into the C heap if
</span><span class="cx">     // necessary. Note that this never allocates in the GC heap.
</span><span class="cx">     static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
</span><del>-    static PassRefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</del><ins>+    static RefPtr&lt;ArrayBufferView&gt; getTypedArrayImpl(JSArrayBufferView*);
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     // Returns true if successful, and false on error; it will throw on error.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -135,7 +135,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         scope.release();
</span><del>-        return ViewClass::create(exec, structure, buffer, offset, length);
</del><ins>+        return ViewClass::create(exec, structure, WTFMove(buffer), offset, length);
</ins><span class="cx">     }
</span><span class="cx">     ASSERT(!offset &amp;&amp; !lengthOpt);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -97,14 +97,14 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> JSGenericTypedArrayView&lt;Adaptor&gt;* JSGenericTypedArrayView&lt;Adaptor&gt;::create(
</span><del>-    ExecState* exec, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; passedBuffer,
</del><ins>+    ExecState* exec, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer,
</ins><span class="cx">     unsigned byteOffset, unsigned length)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
</del><span class="cx">     size_t size = sizeof(typename Adaptor::Type);
</span><del>-    if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, length, size)) {
</del><ins>+    ASSERT(buffer);
+    if (!ArrayBufferView::verifySubRangeLength(*buffer, byteOffset, length, size)) {
</ins><span class="cx">         throwException(exec, scope, createRangeError(exec, &quot;Length out of range of buffer&quot;));
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx">         throwException(exec, scope, createRangeError(exec, &quot;Byte offset is not aligned&quot;));
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><del>-    ConstructionContext context(vm, structure, buffer, byteOffset, length);
</del><ins>+    ConstructionContext context(vm, structure, WTFMove(buffer), byteOffset, length);
</ins><span class="cx">     ASSERT(context);
</span><span class="cx">     JSGenericTypedArrayView* result =
</span><span class="cx">         new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(vm.heap))
</span><span class="lines">@@ -123,10 +123,9 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> JSGenericTypedArrayView&lt;Adaptor&gt;* JSGenericTypedArrayView&lt;Adaptor&gt;::create(
</span><del>-    VM&amp; vm, Structure* structure, PassRefPtr&lt;typename Adaptor::ViewType&gt; impl)
</del><ins>+    VM&amp; vm, Structure* structure, RefPtr&lt;typename Adaptor::ViewType&gt;&amp;&amp; impl)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;ArrayBuffer&gt; buffer = impl-&gt;possiblySharedBuffer();
-    ConstructionContext context(vm, structure, buffer, impl-&gt;byteOffset(), impl-&gt;length());
</del><ins>+    ConstructionContext context(vm, structure, impl-&gt;possiblySharedBuffer(), impl-&gt;byteOffset(), impl-&gt;length());
</ins><span class="cx">     ASSERT(context);
</span><span class="cx">     JSGenericTypedArrayView* result =
</span><span class="cx">         new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(vm.heap))
</span><span class="lines">@@ -138,9 +137,9 @@
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> JSGenericTypedArrayView&lt;Adaptor&gt;* JSGenericTypedArrayView&lt;Adaptor&gt;::create(
</span><span class="cx">     Structure* structure, JSGlobalObject* globalObject,
</span><del>-    PassRefPtr&lt;typename Adaptor::ViewType&gt; impl)
</del><ins>+    RefPtr&lt;typename Adaptor::ViewType&gt;&amp;&amp; impl)
</ins><span class="cx"> {
</span><del>-    return create(globalObject-&gt;vm(), structure, impl);
</del><ins>+    return create(globalObject-&gt;vm(), structure, WTFMove(impl));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="lines">@@ -322,13 +321,13 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><del>-PassRefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::possiblySharedTypedImpl()
</del><ins>+RefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::possiblySharedTypedImpl()
</ins><span class="cx"> {
</span><span class="cx">     return Adaptor::ViewType::create(possiblySharedBuffer(), byteOffset(), length());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><del>-PassRefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::unsharedTypedImpl()
</del><ins>+RefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::unsharedTypedImpl()
</ins><span class="cx"> {
</span><span class="cx">     return Adaptor::ViewType::create(unsharedBuffer(), byteOffset(), length());
</span><span class="cx"> }
</span><span class="lines">@@ -590,8 +589,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><del>-PassRefPtr&lt;ArrayBufferView&gt;
-JSGenericTypedArrayView&lt;Adaptor&gt;::getTypedArrayImpl(JSArrayBufferView* object)
</del><ins>+RefPtr&lt;ArrayBufferView&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::getTypedArrayImpl(JSArrayBufferView* object)
</ins><span class="cx"> {
</span><span class="cx">     JSGenericTypedArrayView* thisObject = jsCast&lt;JSGenericTypedArrayView*&gt;(object);
</span><span class="cx">     return thisObject-&gt;possiblySharedTypedImpl();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -556,7 +556,7 @@
</span><span class="cx"> 
</span><span class="cx">         scope.release();
</span><span class="cx">         return JSValue::encode(ViewClass::create(
</span><del>-            exec, structure, arrayBuffer,
</del><ins>+            exec, structure, WTFMove(arrayBuffer),
</ins><span class="cx">             thisObject-&gt;byteOffset() + offset * ViewClass::elementSize,
</span><span class="cx">             length));
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrays.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrays.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrays.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -49,9 +49,9 @@
</span><span class="cx"> MAKE_S_INFO(Float32);
</span><span class="cx"> MAKE_S_INFO(Float64);
</span><span class="cx"> 
</span><del>-JSUint8Array* createUint8TypedArray(ExecState* exec, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; passedBuffer, unsigned byteOffset, unsigned length)
</del><ins>+JSUint8Array* createUint8TypedArray(ExecState* exec, Structure* structure, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, unsigned byteOffset, unsigned length)
</ins><span class="cx"> {
</span><del>-    return JSUint8Array::create(exec, structure, std::forward&lt;RefPtr&lt;ArrayBuffer&gt;&gt;(passedBuffer), byteOffset, length);
</del><ins>+    return JSUint8Array::create(exec, structure, WTFMove(buffer), byteOffset, length);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypedArrayBaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/TypedArrayBase.h (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypedArrayBase.h        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/JavaScriptCore/runtime/TypedArrayBase.h        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1,150 +0,0 @@
</span><del>-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (c) 2010, Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#pragma once
-
-#include &quot;ArrayBuffer.h&quot;
-#include &quot;ArrayBufferView.h&quot;
-
-namespace JSC {
-
-template &lt;typename T&gt;
-class TypedArrayBase : public ArrayBufferView {
-public:
-    T* data() const { return static_cast&lt;T*&gt;(baseAddress()); }
-
-    bool set(TypedArrayBase&lt;T&gt;* array, unsigned offset)
-    {
-        return setImpl(array, offset * sizeof(T));
-    }
-
-    bool setRange(const T* data, size_t dataLength, unsigned offset)
-    {
-        return setRangeImpl(reinterpret_cast&lt;const char*&gt;(data), dataLength * sizeof(T), offset * sizeof(T));
-    }
-
-    bool zeroRange(unsigned offset, size_t length)
-    {
-        return zeroRangeImpl(offset * sizeof(T), length * sizeof(T));
-    }
-
-    // Overridden from ArrayBufferView. This must be public because of
-    // rules about inheritance of members in template classes, and
-    // because it is accessed via pointers to subclasses.
-    unsigned length() const
-    {
-        return m_length;
-    }
-
-    virtual unsigned byteLength() const
-    {
-        return m_length * sizeof(T);
-    }
-
-    // Invoked by the indexed getter. Does not perform range checks; caller
-    // is responsible for doing so and returning undefined as necessary.
-    T item(unsigned index) const
-    {
-        ASSERT_WITH_SECURITY_IMPLICATION(index &lt; TypedArrayBase&lt;T&gt;::m_length);
-        return TypedArrayBase&lt;T&gt;::data()[index];
-    }
-
-    bool checkInboundData(unsigned offset, unsigned pos) const
-    {
-        return (offset &lt;= m_length
-            &amp;&amp; offset + pos &lt;= m_length
-            // check overflow
-            &amp;&amp; offset + pos &gt;= offset);
-    }
-
-protected:
-    TypedArrayBase(PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned length)
-        : ArrayBufferView(buffer, byteOffset)
-        , m_length(length)
-    {
-    }
-
-    template &lt;class Subclass&gt;
-    static PassRefPtr&lt;Subclass&gt; create(unsigned length)
-    {
-        RefPtr&lt;ArrayBuffer&gt; buffer = ArrayBuffer::create(length, sizeof(T));
-        if (!buffer.get())
-            return 0;
-        return create&lt;Subclass&gt;(buffer.release(), 0, length);
-    }
-
-    template &lt;class Subclass&gt;
-    static PassRefPtr&lt;Subclass&gt; create(const T* array, unsigned length)
-    {
-        RefPtr&lt;Subclass&gt; a = create&lt;Subclass&gt;(length);
-        if (a)
-            for (unsigned i = 0; i &lt; length; ++i)
-                a-&gt;set(i, array[i]);
-        return a.release();
-    }
-
-    template &lt;class Subclass&gt;
-    static RefPtr&lt;Subclass&gt; create(PassRefPtr&lt;ArrayBuffer&gt; buffer, unsigned byteOffset, unsigned length)
-    {
-        RefPtr&lt;ArrayBuffer&gt; buf(buffer);
-        if (!verifySubRange&lt;T&gt;(buf, byteOffset, length))
-            return nullptr;
-
-        return adoptRef(new Subclass(buf.release(), byteOffset, length));
-    }
-
-    template &lt;class Subclass&gt;
-    static RefPtr&lt;Subclass&gt; createUninitialized(unsigned length)
-    {
-        RefPtr&lt;ArrayBuffer&gt; buffer = ArrayBuffer::createUninitialized(length, sizeof(T));
-        if (!buffer.get())
-            return nullptr;
-        return create&lt;Subclass&gt;(buffer.release(), 0, length);
-    }
-
-    template &lt;class Subclass&gt;
-    RefPtr&lt;Subclass&gt; subarrayImpl(int start, int end) const
-    {
-        unsigned offset, length;
-        calculateOffsetAndLength(start, end, m_length, &amp;offset, &amp;length);
-        clampOffsetAndNumElements&lt;T&gt;(buffer(), m_byteOffset, &amp;offset, &amp;length);
-        return create&lt;Subclass&gt;(buffer(), offset, length);
-    }
-
-    virtual void neuter()
-    {
-        ArrayBufferView::neuter();
-        m_length = 0;
-    }
-
-    // We do not want to have to access this via a virtual function in subclasses,
-    // which is why it is protected rather than private.
-    unsigned m_length;
-};
-
-} // namespace JSC
-
-using JSC::TypedArrayBase;
</del></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/ChangeLog        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2017-02-16  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [JSC] Drop PassRefPtr from ArrayBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=168455
+
+        Reviewed by Geoffrey Garen.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readArrayBufferView):
+        * css/FontFace.cpp:
+        (WebCore::FontFace::create):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::extractKeyURIKeyIDAndCertificateFromInitData):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::AVFWrapper::shouldWaitForLoadingOfResource):
+        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
+        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource):
+
</ins><span class="cx"> 2017-02-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         REGRESSION(r212439): Web Inspector Toolbar / Window appears broken
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsSerializedScriptValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1856,34 +1856,34 @@
</span><span class="cx">         RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toPossiblySharedArrayBuffer(vm, arrayBufferObj);
</span><span class="cx">         switch (arrayBufferViewSubtag) {
</span><span class="cx">         case DataViewTag:
</span><del>-            arrayBufferView = getJSValue(DataView::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = getJSValue(DataView::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Int8ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Int8Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Int8Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Uint8ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Uint8Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Uint8Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Uint8ClampedArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Uint8ClampedArray::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Uint8ClampedArray::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Int16ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Int16Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Int16Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Uint16ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Uint16Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Uint16Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Int32ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Int32Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Int32Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Uint32ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Uint32Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Uint32Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Float32ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Float32Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Float32Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         case Float64ArrayTag:
</span><del>-            arrayBufferView = toJS(m_exec, m_globalObject, Float64Array::create(arrayBuffer, byteOffset, length).get());
</del><ins>+            arrayBufferView = toJS(m_exec, m_globalObject, Float64Array::create(WTFMove(arrayBuffer), byteOffset, length).get());
</ins><span class="cx">             return true;
</span><span class="cx">         default:
</span><span class="cx">             return false;
</span></span></pre></div>
<a id="trunkSourceWebCorecssFontFacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/FontFace.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/css/FontFace.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/css/FontFace.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -72,7 +72,8 @@
</span><span class="cx">             return { };
</span><span class="cx">         },
</span><span class="cx">         [&amp;] (RefPtr&lt;ArrayBuffer&gt;&amp; arrayBuffer) -&gt; ExceptionOr&lt;void&gt; {
</span><del>-            auto arrayBufferView = JSC::Uint8Array::create(arrayBuffer, 0, arrayBuffer-&gt;byteLength());
</del><ins>+            unsigned byteLength = arrayBuffer-&gt;byteLength();
+            auto arrayBufferView = JSC::Uint8Array::create(WTFMove(arrayBuffer), 0, byteLength);
</ins><span class="cx">             dataRequiresAsynchronousLoading = populateFontFaceWithArrayBuffer(result-&gt;backing(), arrayBufferView.releaseNonNull());
</span><span class="cx">             return { };
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsavfoundationMediaPlayerPrivateAVFoundationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -41,7 +41,9 @@
</span><span class="cx"> #include &quot;Settings.h&quot;
</span><span class="cx"> #include &quot;SoftLinking.h&quot;
</span><span class="cx"> #include &lt;CoreMedia/CoreMedia.h&gt;
</span><ins>+#include &lt;heap/HeapInlines.h&gt;
</ins><span class="cx"> #include &lt;runtime/DataView.h&gt;
</span><ins>+#include &lt;runtime/TypedArrayInlines.h&gt;
</ins><span class="cx"> #include &lt;runtime/Uint16Array.h&gt;
</span><span class="cx"> #include &lt;wtf/MainThread.h&gt;
</span><span class="cx"> #include &lt;wtf/NeverDestroyed.h&gt;
</span><span class="lines">@@ -1028,7 +1030,7 @@
</span><span class="cx">     RefPtr&lt;ArrayBuffer&gt; initDataBuffer = initData-&gt;unsharedBuffer();
</span><span class="cx"> 
</span><span class="cx">     // Use a DataView to read uint32 values from the buffer, as Uint32Array requires the reads be aligned on 4-byte boundaries. 
</span><del>-    RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer, 0, initDataBuffer-&gt;byteLength());
</del><ins>+    RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer.copyRef(), 0, initDataBuffer-&gt;byteLength());
</ins><span class="cx">     uint32_t offset = 0;
</span><span class="cx">     bool status = true;
</span><span class="cx"> 
</span><span class="lines">@@ -1037,7 +1039,7 @@
</span><span class="cx">     if (!status || offset + keyURILength &gt; initData-&gt;length())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer, offset, keyURILength);
</del><ins>+    RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer.copyRef(), offset, keyURILength);
</ins><span class="cx">     if (!keyURIArray)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -1049,7 +1051,7 @@
</span><span class="cx">     if (!status || offset + keyIDLength &gt; initData-&gt;length())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Uint8Array&gt; keyIDArray = Uint8Array::create(initDataBuffer, offset, keyIDLength);
</del><ins>+    RefPtr&lt;Uint8Array&gt; keyIDArray = Uint8Array::create(initDataBuffer.copyRef(), offset, keyIDLength);
</ins><span class="cx">     if (!keyIDArray)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -1061,7 +1063,7 @@
</span><span class="cx">     if (!status || offset + certificateLength &gt; initData-&gt;length())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    certificate = Uint8Array::create(initDataBuffer, offset, certificateLength);
</del><ins>+    certificate = Uint8Array::create(WTFMove(initDataBuffer), offset, certificateLength);
</ins><span class="cx">     if (!certificate)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsavfoundationcfMediaPlayerPrivateAVFoundationCFcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1911,13 +1911,14 @@
</span><span class="cx">         // [4 bytes: keyURI size], [keyURI size bytes: keyURI]
</span><span class="cx">         unsigned keyURISize = keyURI.length() * sizeof(UChar);
</span><span class="cx">         RefPtr&lt;ArrayBuffer&gt; initDataBuffer = ArrayBuffer::create(4 + keyURISize, 1);
</span><del>-        RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer, 0, initDataBuffer-&gt;byteLength());
</del><ins>+        RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer.copyRef(), 0, initDataBuffer-&gt;byteLength());
</ins><span class="cx">         initDataView-&gt;set&lt;uint32_t&gt;(0, keyURISize, true);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer, 4, keyURI.length());
</del><ins>+        RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer.copyRef(), 4, keyURI.length());
</ins><span class="cx">         keyURIArray-&gt;setRange(reinterpret_cast&lt;const uint16_t*&gt;(StringView(keyURI).upconvertedCharacters().get()), keyURI.length() / sizeof(unsigned char), 0);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;Uint8Array&gt; initData = Uint8Array::create(initDataBuffer, 0, initDataBuffer-&gt;byteLength());
</del><ins>+        unsigned byteLength = initDataBuffer-&gt;byteLength();
+        RefPtr&lt;Uint8Array&gt; initData = Uint8Array::create(WTFMove(initDataBuffer), 0, byteLength);
</ins><span class="cx">         if (!m_owner-&gt;player()-&gt;keyNeeded(initData.get()))
</span><span class="cx">             return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsavfoundationobjcCDMSessionAVFoundationObjCmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx"> #import &lt;AVFoundation/AVAsset.h&gt;
</span><span class="cx"> #import &lt;AVFoundation/AVAssetResourceLoader.h&gt;
</span><span class="cx"> #import &lt;objc/objc-runtime.h&gt;
</span><ins>+#import &lt;runtime/TypedArrayInlines.h&gt;
</ins><span class="cx"> #import &lt;wtf/MainThread.h&gt;
</span><span class="cx"> 
</span><span class="cx"> SOFT_LINK_FRAMEWORK_OPTIONAL(AVFoundation)
</span><span class="lines">@@ -100,7 +101,8 @@
</span><span class="cx">     destinationURL = String();
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;ArrayBuffer&gt; keyRequestBuffer = ArrayBuffer::create([keyRequest.get() bytes], [keyRequest.get() length]);
</span><del>-    return Uint8Array::create(keyRequestBuffer, 0, keyRequestBuffer-&gt;byteLength());
</del><ins>+    unsigned byteLength = keyRequestBuffer-&gt;byteLength();
+    return Uint8Array::create(WTFMove(keyRequestBuffer), 0, byteLength);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CDMSessionAVFoundationObjC::releaseKeys()
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsavfoundationobjcMediaPlayerPrivateAVFoundationObjCmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm (212534 => 212535)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm        2017-02-17 06:03:14 UTC (rev 212534)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm        2017-02-17 06:04:16 UTC (rev 212535)
</span><span class="lines">@@ -1770,19 +1770,22 @@
</span><span class="cx">         // [4 bytes: keyURI size], [keyURI size bytes: keyURI]
</span><span class="cx">         unsigned keyURISize = keyURI.length() * sizeof(UChar);
</span><span class="cx">         RefPtr&lt;ArrayBuffer&gt; initDataBuffer = ArrayBuffer::create(4 + keyURISize, 1);
</span><del>-        RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer, 0, initDataBuffer-&gt;byteLength());
</del><ins>+        unsigned byteLength = initDataBuffer-&gt;byteLength();
+        RefPtr&lt;JSC::DataView&gt; initDataView = JSC::DataView::create(initDataBuffer.copyRef(), 0, byteLength);
</ins><span class="cx">         initDataView-&gt;set&lt;uint32_t&gt;(0, keyURISize, true);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer, 4, keyURI.length());
</del><ins>+        RefPtr&lt;Uint16Array&gt; keyURIArray = Uint16Array::create(initDataBuffer.copyRef(), 4, keyURI.length());
</ins><span class="cx">         keyURIArray-&gt;setRange(StringView(keyURI).upconvertedCharacters(), keyURI.length() / sizeof(unsigned char), 0);
</span><span class="cx"> 
</span><del>-        RefPtr&lt;Uint8Array&gt; initData = Uint8Array::create(initDataBuffer, 0, initDataBuffer-&gt;byteLength());
</del><ins>+        RefPtr&lt;Uint8Array&gt; initData = Uint8Array::create(WTFMove(initDataBuffer), 0, byteLength);
</ins><span class="cx">         if (!player()-&gt;keyNeeded(initData.get()))
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="cx">         m_keyURIToRequestMap.set(keyURI, avRequest);
</span><span class="cx">         return true;
</span><del>-    } else if (scheme == &quot;clearkey&quot;) {
</del><ins>+    }
+
+    if (scheme == &quot;clearkey&quot;) {
</ins><span class="cx">         String keyID = [[[avRequest request] URL] resourceSpecifier];
</span><span class="cx">         StringView keyIDView(keyID);
</span><span class="cx">         CString utf8EncodedKeyId = UTF8Encoding().encode(keyIDView, URLEncodedEntitiesForUnencodables);
</span></span></pre>
</div>
</div>

</body>
</html>