js/src/vm/TypedArrayObject.cpp

changeset 0
6474c204b198
     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/vm/TypedArrayObject.cpp	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,2761 @@
     1.4 +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
     1.5 + * vim: set ts=8 sts=4 et sw=4 tw=99:
     1.6 + * This Source Code Form is subject to the terms of the Mozilla Public
     1.7 + * License, v. 2.0. If a copy of the MPL was not distributed with this
     1.8 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
     1.9 +
    1.10 +#include "vm/TypedArrayObject.h"
    1.11 +
    1.12 +#include "mozilla/Alignment.h"
    1.13 +#include "mozilla/FloatingPoint.h"
    1.14 +#include "mozilla/PodOperations.h"
    1.15 +
    1.16 +#include <string.h>
    1.17 +#ifndef XP_WIN
    1.18 +# include <sys/mman.h>
    1.19 +#endif
    1.20 +
    1.21 +#include "jsapi.h"
    1.22 +#include "jsarray.h"
    1.23 +#include "jscntxt.h"
    1.24 +#include "jscpucfg.h"
    1.25 +#include "jsnum.h"
    1.26 +#include "jsobj.h"
    1.27 +#include "jstypes.h"
    1.28 +#include "jsutil.h"
    1.29 +#ifdef XP_WIN
    1.30 +# include "jswin.h"
    1.31 +#endif
    1.32 +#include "jswrapper.h"
    1.33 +
    1.34 +#include "gc/Barrier.h"
    1.35 +#include "gc/Marking.h"
    1.36 +#include "jit/AsmJS.h"
    1.37 +#include "jit/AsmJSModule.h"
    1.38 +#include "vm/ArrayBufferObject.h"
    1.39 +#include "vm/GlobalObject.h"
    1.40 +#include "vm/Interpreter.h"
    1.41 +#include "vm/NumericConversions.h"
    1.42 +#include "vm/SharedArrayObject.h"
    1.43 +#include "vm/WrapperObject.h"
    1.44 +
    1.45 +#include "jsatominlines.h"
    1.46 +#include "jsinferinlines.h"
    1.47 +#include "jsobjinlines.h"
    1.48 +
    1.49 +#include "vm/Shape-inl.h"
    1.50 +
    1.51 +using namespace js;
    1.52 +using namespace js::gc;
    1.53 +using namespace js::types;
    1.54 +
    1.55 +using mozilla::IsNaN;
    1.56 +using mozilla::NegativeInfinity;
    1.57 +using mozilla::PodCopy;
    1.58 +using mozilla::PositiveInfinity;
    1.59 +using JS::CanonicalizeNaN;
    1.60 +using JS::GenericNaN;
    1.61 +
    1.62 +static bool
    1.63 +ValueIsLength(const Value &v, uint32_t *len)
    1.64 +{
    1.65 +    if (v.isInt32()) {
    1.66 +        int32_t i = v.toInt32();
    1.67 +        if (i < 0)
    1.68 +            return false;
    1.69 +        *len = i;
    1.70 +        return true;
    1.71 +    }
    1.72 +
    1.73 +    if (v.isDouble()) {
    1.74 +        double d = v.toDouble();
    1.75 +        if (IsNaN(d))
    1.76 +            return false;
    1.77 +
    1.78 +        uint32_t length = uint32_t(d);
    1.79 +        if (d != double(length))
    1.80 +            return false;
    1.81 +
    1.82 +        *len = length;
    1.83 +        return true;
    1.84 +    }
    1.85 +
    1.86 +    return false;
    1.87 +}
    1.88 +
    1.89 +/*
    1.90 + * TypedArrayObject
    1.91 + *
    1.92 + * The non-templated base class for the specific typed implementations.
    1.93 + * This class holds all the member variables that are used by
    1.94 + * the subclasses.
    1.95 + */
    1.96 +
    1.97 +void
    1.98 +TypedArrayObject::neuter(void *newData)
    1.99 +{
   1.100 +    setSlot(LENGTH_SLOT, Int32Value(0));
   1.101 +    setSlot(BYTELENGTH_SLOT, Int32Value(0));
   1.102 +    setSlot(BYTEOFFSET_SLOT, Int32Value(0));
   1.103 +    setPrivate(newData);
   1.104 +}
   1.105 +
   1.106 +ArrayBufferObject *
   1.107 +TypedArrayObject::sharedBuffer() const
   1.108 +{
   1.109 +    return &bufferValue(const_cast<TypedArrayObject*>(this)).toObject().as<SharedArrayBufferObject>();
   1.110 +}
   1.111 +
   1.112 +/* static */ bool
   1.113 +TypedArrayObject::ensureHasBuffer(JSContext *cx, Handle<TypedArrayObject *> tarray)
   1.114 +{
   1.115 +    if (tarray->buffer())
   1.116 +        return true;
   1.117 +
   1.118 +    Rooted<ArrayBufferObject *> buffer(cx, ArrayBufferObject::create(cx, tarray->byteLength()));
   1.119 +    if (!buffer)
   1.120 +        return false;
   1.121 +
   1.122 +    buffer->addView(tarray);
   1.123 +
   1.124 +    memcpy(buffer->dataPointer(), tarray->viewData(), tarray->byteLength());
   1.125 +    InitArrayBufferViewDataPointer(tarray, buffer, 0);
   1.126 +
   1.127 +    tarray->setSlot(BUFFER_SLOT, ObjectValue(*buffer));
   1.128 +    return true;
   1.129 +}
   1.130 +
   1.131 +/* static */ int
   1.132 +TypedArrayObject::lengthOffset()
   1.133 +{
   1.134 +    return JSObject::getFixedSlotOffset(LENGTH_SLOT);
   1.135 +}
   1.136 +
   1.137 +/* static */ int
   1.138 +TypedArrayObject::dataOffset()
   1.139 +{
   1.140 +    return JSObject::getPrivateDataOffset(DATA_SLOT);
   1.141 +}
   1.142 +
   1.143 +/* Helper clamped uint8_t type */
   1.144 +
   1.145 +uint32_t JS_FASTCALL
   1.146 +js::ClampDoubleToUint8(const double x)
   1.147 +{
   1.148 +    // Not < so that NaN coerces to 0
   1.149 +    if (!(x >= 0))
   1.150 +        return 0;
   1.151 +
   1.152 +    if (x > 255)
   1.153 +        return 255;
   1.154 +
   1.155 +    double toTruncate = x + 0.5;
   1.156 +    uint8_t y = uint8_t(toTruncate);
   1.157 +
   1.158 +    /*
   1.159 +     * now val is rounded to nearest, ties rounded up.  We want
   1.160 +     * rounded to nearest ties to even, so check whether we had a
   1.161 +     * tie.
   1.162 +     */
   1.163 +    if (y == toTruncate) {
   1.164 +        /*
   1.165 +         * It was a tie (since adding 0.5 gave us the exact integer
   1.166 +         * we want).  Since we rounded up, we either already have an
   1.167 +         * even number or we have an odd number but the number we
   1.168 +         * want is one less.  So just unconditionally masking out the
   1.169 +         * ones bit should do the trick to get us the value we
   1.170 +         * want.
   1.171 +         */
   1.172 +        return y & ~1;
   1.173 +    }
   1.174 +
   1.175 +    return y;
   1.176 +}
   1.177 +
   1.178 +template<typename NativeType> static inline const int TypeIDOfType();
   1.179 +template<> inline const int TypeIDOfType<int8_t>() { return ScalarTypeDescr::TYPE_INT8; }
   1.180 +template<> inline const int TypeIDOfType<uint8_t>() { return ScalarTypeDescr::TYPE_UINT8; }
   1.181 +template<> inline const int TypeIDOfType<int16_t>() { return ScalarTypeDescr::TYPE_INT16; }
   1.182 +template<> inline const int TypeIDOfType<uint16_t>() { return ScalarTypeDescr::TYPE_UINT16; }
   1.183 +template<> inline const int TypeIDOfType<int32_t>() { return ScalarTypeDescr::TYPE_INT32; }
   1.184 +template<> inline const int TypeIDOfType<uint32_t>() { return ScalarTypeDescr::TYPE_UINT32; }
   1.185 +template<> inline const int TypeIDOfType<float>() { return ScalarTypeDescr::TYPE_FLOAT32; }
   1.186 +template<> inline const int TypeIDOfType<double>() { return ScalarTypeDescr::TYPE_FLOAT64; }
   1.187 +template<> inline const int TypeIDOfType<uint8_clamped>() { return ScalarTypeDescr::TYPE_UINT8_CLAMPED; }
   1.188 +
   1.189 +template<typename ElementType>
   1.190 +static inline JSObject *
   1.191 +NewArray(JSContext *cx, uint32_t nelements);
   1.192 +
   1.193 +namespace {
   1.194 +
   1.195 +template<typename NativeType>
   1.196 +class TypedArrayObjectTemplate : public TypedArrayObject
   1.197 +{
   1.198 +  public:
   1.199 +    typedef NativeType ThisType;
   1.200 +    typedef TypedArrayObjectTemplate<NativeType> ThisTypedArrayObject;
   1.201 +    static const int ArrayTypeID() { return TypeIDOfType<NativeType>(); }
   1.202 +    static const bool ArrayTypeIsUnsigned() { return TypeIsUnsigned<NativeType>(); }
   1.203 +    static const bool ArrayTypeIsFloatingPoint() { return TypeIsFloatingPoint<NativeType>(); }
   1.204 +
   1.205 +    static const size_t BYTES_PER_ELEMENT = sizeof(ThisType);
   1.206 +
   1.207 +    static inline const Class *protoClass()
   1.208 +    {
   1.209 +        return &TypedArrayObject::protoClasses[ArrayTypeID()];
   1.210 +    }
   1.211 +
   1.212 +    static inline const Class *instanceClass()
   1.213 +    {
   1.214 +        return &TypedArrayObject::classes[ArrayTypeID()];
   1.215 +    }
   1.216 +
   1.217 +    static bool is(HandleValue v) {
   1.218 +        return v.isObject() && v.toObject().hasClass(instanceClass());
   1.219 +    }
   1.220 +
   1.221 +    static void
   1.222 +    setIndexValue(TypedArrayObject &tarray, uint32_t index, double d)
   1.223 +    {
   1.224 +        // If the array is an integer array, we only handle up to
   1.225 +        // 32-bit ints from this point on.  if we want to handle
   1.226 +        // 64-bit ints, we'll need some changes.
   1.227 +
   1.228 +        // Assign based on characteristics of the destination type
   1.229 +        if (ArrayTypeIsFloatingPoint()) {
   1.230 +            setIndex(tarray, index, NativeType(d));
   1.231 +        } else if (ArrayTypeIsUnsigned()) {
   1.232 +            JS_ASSERT(sizeof(NativeType) <= 4);
   1.233 +            uint32_t n = ToUint32(d);
   1.234 +            setIndex(tarray, index, NativeType(n));
   1.235 +        } else if (ArrayTypeID() == ScalarTypeDescr::TYPE_UINT8_CLAMPED) {
   1.236 +            // The uint8_clamped type has a special rounding converter
   1.237 +            // for doubles.
   1.238 +            setIndex(tarray, index, NativeType(d));
   1.239 +        } else {
   1.240 +            JS_ASSERT(sizeof(NativeType) <= 4);
   1.241 +            int32_t n = ToInt32(d);
   1.242 +            setIndex(tarray, index, NativeType(n));
   1.243 +        }
   1.244 +    }
   1.245 +
   1.246 +    static TypedArrayObject *
   1.247 +    makeProtoInstance(JSContext *cx, HandleObject proto, AllocKind allocKind)
   1.248 +    {
   1.249 +        JS_ASSERT(proto);
   1.250 +
   1.251 +        RootedObject obj(cx, NewBuiltinClassInstance(cx, instanceClass(), allocKind));
   1.252 +        if (!obj)
   1.253 +            return nullptr;
   1.254 +
   1.255 +        types::TypeObject *type = cx->getNewType(obj->getClass(), proto.get());
   1.256 +        if (!type)
   1.257 +            return nullptr;
   1.258 +        obj->setType(type);
   1.259 +
   1.260 +        return &obj->as<TypedArrayObject>();
   1.261 +    }
   1.262 +
   1.263 +    static TypedArrayObject *
   1.264 +    makeTypedInstance(JSContext *cx, uint32_t len, AllocKind allocKind)
   1.265 +    {
   1.266 +        if (len * sizeof(NativeType) >= TypedArrayObject::SINGLETON_TYPE_BYTE_LENGTH) {
   1.267 +            return &NewBuiltinClassInstance(cx, instanceClass(), allocKind,
   1.268 +                                            SingletonObject)->as<TypedArrayObject>();
   1.269 +        }
   1.270 +
   1.271 +        jsbytecode *pc;
   1.272 +        RootedScript script(cx, cx->currentScript(&pc));
   1.273 +        NewObjectKind newKind = script
   1.274 +                                ? UseNewTypeForInitializer(script, pc, instanceClass())
   1.275 +                                : GenericObject;
   1.276 +        RootedObject obj(cx, NewBuiltinClassInstance(cx, instanceClass(), allocKind, newKind));
   1.277 +        if (!obj)
   1.278 +            return nullptr;
   1.279 +
   1.280 +        if (script) {
   1.281 +            if (!types::SetInitializerObjectType(cx, script, pc, obj, newKind))
   1.282 +                return nullptr;
   1.283 +        }
   1.284 +
   1.285 +        return &obj->as<TypedArrayObject>();
   1.286 +    }
   1.287 +
   1.288 +    static JSObject *
   1.289 +    makeInstance(JSContext *cx, Handle<ArrayBufferObject *> buffer, uint32_t byteOffset, uint32_t len,
   1.290 +                 HandleObject proto)
   1.291 +    {
   1.292 +        JS_ASSERT_IF(!buffer, byteOffset == 0);
   1.293 +
   1.294 +        gc::AllocKind allocKind = buffer
   1.295 +                                  ? GetGCObjectKind(instanceClass())
   1.296 +                                  : AllocKindForLazyBuffer(len * sizeof(NativeType));
   1.297 +
   1.298 +        Rooted<TypedArrayObject*> obj(cx);
   1.299 +        if (proto)
   1.300 +            obj = makeProtoInstance(cx, proto, allocKind);
   1.301 +        else
   1.302 +            obj = makeTypedInstance(cx, len, allocKind);
   1.303 +        if (!obj)
   1.304 +            return nullptr;
   1.305 +
   1.306 +        obj->setSlot(TYPE_SLOT, Int32Value(ArrayTypeID()));
   1.307 +        obj->setSlot(BUFFER_SLOT, ObjectOrNullValue(buffer));
   1.308 +
   1.309 +        if (buffer) {
   1.310 +            InitArrayBufferViewDataPointer(obj, buffer, byteOffset);
   1.311 +        } else {
   1.312 +            void *data = obj->fixedData(FIXED_DATA_START);
   1.313 +            obj->initPrivate(data);
   1.314 +            memset(data, 0, len * sizeof(NativeType));
   1.315 +        }
   1.316 +
   1.317 +        obj->setSlot(LENGTH_SLOT, Int32Value(len));
   1.318 +        obj->setSlot(BYTEOFFSET_SLOT, Int32Value(byteOffset));
   1.319 +        obj->setSlot(BYTELENGTH_SLOT, Int32Value(len * sizeof(NativeType)));
   1.320 +        obj->setSlot(NEXT_VIEW_SLOT, PrivateValue(nullptr));
   1.321 +
   1.322 +#ifdef DEBUG
   1.323 +        if (buffer) {
   1.324 +            uint32_t arrayByteLength = obj->byteLength();
   1.325 +            uint32_t arrayByteOffset = obj->byteOffset();
   1.326 +            uint32_t bufferByteLength = buffer->byteLength();
   1.327 +            JS_ASSERT_IF(!buffer->isNeutered(), buffer->dataPointer() <= obj->viewData());
   1.328 +            JS_ASSERT(bufferByteLength - arrayByteOffset >= arrayByteLength);
   1.329 +            JS_ASSERT(arrayByteOffset <= bufferByteLength);
   1.330 +        }
   1.331 +
   1.332 +        // Verify that the private slot is at the expected place
   1.333 +        JS_ASSERT(obj->numFixedSlots() == DATA_SLOT);
   1.334 +#endif
   1.335 +
   1.336 +        if (buffer)
   1.337 +            buffer->addView(obj);
   1.338 +
   1.339 +        return obj;
   1.340 +    }
   1.341 +
   1.342 +    static JSObject *
   1.343 +    makeInstance(JSContext *cx, Handle<ArrayBufferObject *> bufobj, uint32_t byteOffset, uint32_t len)
   1.344 +    {
   1.345 +        RootedObject nullproto(cx, nullptr);
   1.346 +        return makeInstance(cx, bufobj, byteOffset, len, nullproto);
   1.347 +    }
   1.348 +
   1.349 +    /*
   1.350 +     * new [Type]Array(length)
   1.351 +     * new [Type]Array(otherTypedArray)
   1.352 +     * new [Type]Array(JSArray)
   1.353 +     * new [Type]Array(ArrayBuffer, [optional] byteOffset, [optional] length)
   1.354 +     */
   1.355 +    static bool
   1.356 +    class_constructor(JSContext *cx, unsigned argc, Value *vp)
   1.357 +    {
   1.358 +        /* N.B. this is a constructor for protoClass, not instanceClass! */
   1.359 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.360 +        JSObject *obj = create(cx, args);
   1.361 +        if (!obj)
   1.362 +            return false;
   1.363 +        args.rval().setObject(*obj);
   1.364 +        return true;
   1.365 +    }
   1.366 +
   1.367 +    static JSObject *
   1.368 +    create(JSContext *cx, const CallArgs& args)
   1.369 +    {
   1.370 +        /* () or (number) */
   1.371 +        uint32_t len = 0;
   1.372 +        if (args.length() == 0 || ValueIsLength(args[0], &len))
   1.373 +            return fromLength(cx, len);
   1.374 +
   1.375 +        /* (not an object) */
   1.376 +        if (!args[0].isObject()) {
   1.377 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.378 +            return nullptr;
   1.379 +        }
   1.380 +
   1.381 +        RootedObject dataObj(cx, &args.get(0).toObject());
   1.382 +
   1.383 +        /*
   1.384 +         * (typedArray)
   1.385 +         * (type[] array)
   1.386 +         *
   1.387 +         * Otherwise create a new typed array and copy elements 0..len-1
   1.388 +         * properties from the object, treating it as some sort of array.
   1.389 +         * Note that offset and length will be ignored
   1.390 +         */
   1.391 +        if (!UncheckedUnwrap(dataObj)->is<ArrayBufferObject>() &&
   1.392 +            !UncheckedUnwrap(dataObj)->is<SharedArrayBufferObject>())
   1.393 +        {
   1.394 +            return fromArray(cx, dataObj);
   1.395 +        }
   1.396 +
   1.397 +        /* (ArrayBuffer, [byteOffset, [length]]) */
   1.398 +        int32_t byteOffset = 0;
   1.399 +        int32_t length = -1;
   1.400 +
   1.401 +        if (args.length() > 1) {
   1.402 +            if (!ToInt32(cx, args[1], &byteOffset))
   1.403 +                return nullptr;
   1.404 +            if (byteOffset < 0) {
   1.405 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
   1.406 +                                     JSMSG_TYPED_ARRAY_NEGATIVE_ARG, "1");
   1.407 +                return nullptr;
   1.408 +            }
   1.409 +
   1.410 +            if (args.length() > 2) {
   1.411 +                if (!ToInt32(cx, args[2], &length))
   1.412 +                    return nullptr;
   1.413 +                if (length < 0) {
   1.414 +                    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
   1.415 +                                         JSMSG_TYPED_ARRAY_NEGATIVE_ARG, "2");
   1.416 +                    return nullptr;
   1.417 +                }
   1.418 +            }
   1.419 +        }
   1.420 +
   1.421 +        Rooted<JSObject*> proto(cx, nullptr);
   1.422 +        return fromBuffer(cx, dataObj, byteOffset, length, proto);
   1.423 +    }
   1.424 +
   1.425 +    static bool IsThisClass(HandleValue v) {
   1.426 +        return v.isObject() && v.toObject().hasClass(instanceClass());
   1.427 +    }
   1.428 +
   1.429 +    template<Value ValueGetter(TypedArrayObject *tarr)>
   1.430 +    static bool
   1.431 +    GetterImpl(JSContext *cx, CallArgs args)
   1.432 +    {
   1.433 +        JS_ASSERT(IsThisClass(args.thisv()));
   1.434 +        args.rval().set(ValueGetter(&args.thisv().toObject().as<TypedArrayObject>()));
   1.435 +        return true;
   1.436 +    }
   1.437 +
   1.438 +    // ValueGetter is a function that takes an unwrapped typed array object and
   1.439 +    // returns a Value. Given such a function, Getter<> is a native that
   1.440 +    // retrieves a given Value, probably from a slot on the object.
   1.441 +    template<Value ValueGetter(TypedArrayObject *tarr)>
   1.442 +    static bool
   1.443 +    Getter(JSContext *cx, unsigned argc, Value *vp)
   1.444 +    {
   1.445 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.446 +        return CallNonGenericMethod<ThisTypedArrayObject::IsThisClass,
   1.447 +                                    ThisTypedArrayObject::GetterImpl<ValueGetter> >(cx, args);
   1.448 +    }
   1.449 +
   1.450 +    static bool
   1.451 +    BufferGetterImpl(JSContext *cx, CallArgs args)
   1.452 +    {
   1.453 +        JS_ASSERT(IsThisClass(args.thisv()));
   1.454 +        Rooted<TypedArrayObject *> tarray(cx, &args.thisv().toObject().as<TypedArrayObject>());
   1.455 +        if (!ensureHasBuffer(cx, tarray))
   1.456 +            return false;
   1.457 +        args.rval().set(bufferValue(tarray));
   1.458 +        return true;
   1.459 +    }
   1.460 +
   1.461 +    // BufferGetter is a function that lazily constructs the array buffer for a
   1.462 +    // typed array before fetching it.
   1.463 +    static bool
   1.464 +    BufferGetter(JSContext *cx, unsigned argc, Value *vp)
   1.465 +    {
   1.466 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.467 +        return CallNonGenericMethod<ThisTypedArrayObject::IsThisClass,
   1.468 +                                    ThisTypedArrayObject::BufferGetterImpl>(cx, args);
   1.469 +    }
   1.470 +
   1.471 +    // Define an accessor for a read-only property that invokes a native getter
   1.472 +    static bool
   1.473 +    DefineGetter(JSContext *cx, HandleObject proto, PropertyName *name, Native native)
   1.474 +    {
   1.475 +        RootedId id(cx, NameToId(name));
   1.476 +        unsigned attrs = JSPROP_SHARED | JSPROP_GETTER | JSPROP_PERMANENT;
   1.477 +
   1.478 +        Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
   1.479 +        JSObject *getter = NewFunction(cx, NullPtr(), native, 0,
   1.480 +                                       JSFunction::NATIVE_FUN, global, NullPtr());
   1.481 +        if (!getter)
   1.482 +            return false;
   1.483 +
   1.484 +        return DefineNativeProperty(cx, proto, id, UndefinedHandleValue,
   1.485 +                                    JS_DATA_TO_FUNC_PTR(PropertyOp, getter), nullptr,
   1.486 +                                    attrs);
   1.487 +    }
   1.488 +
   1.489 +    static
   1.490 +    bool defineGetters(JSContext *cx, HandleObject proto)
   1.491 +    {
   1.492 +        if (!DefineGetter(cx, proto, cx->names().length, Getter<lengthValue>))
   1.493 +            return false;
   1.494 +
   1.495 +        if (!DefineGetter(cx, proto, cx->names().buffer, BufferGetter))
   1.496 +            return false;
   1.497 +
   1.498 +        if (!DefineGetter(cx, proto, cx->names().byteLength, Getter<byteLengthValue>))
   1.499 +            return false;
   1.500 +
   1.501 +        if (!DefineGetter(cx, proto, cx->names().byteOffset, Getter<byteOffsetValue>))
   1.502 +            return false;
   1.503 +
   1.504 +        return true;
   1.505 +    }
   1.506 +
   1.507 +    /* subarray(start[, end]) */
   1.508 +    static bool
   1.509 +    fun_subarray_impl(JSContext *cx, CallArgs args)
   1.510 +    {
   1.511 +        JS_ASSERT(IsThisClass(args.thisv()));
   1.512 +        Rooted<TypedArrayObject*> tarray(cx, &args.thisv().toObject().as<TypedArrayObject>());
   1.513 +
   1.514 +        // these are the default values
   1.515 +        uint32_t length = tarray->length();
   1.516 +        uint32_t begin = 0, end = length;
   1.517 +
   1.518 +        if (args.length() > 0) {
   1.519 +            if (!ToClampedIndex(cx, args[0], length, &begin))
   1.520 +                return false;
   1.521 +
   1.522 +            if (args.length() > 1) {
   1.523 +                if (!ToClampedIndex(cx, args[1], length, &end))
   1.524 +                    return false;
   1.525 +            }
   1.526 +        }
   1.527 +
   1.528 +        if (begin > end)
   1.529 +            begin = end;
   1.530 +
   1.531 +        JSObject *nobj = createSubarray(cx, tarray, begin, end);
   1.532 +        if (!nobj)
   1.533 +            return false;
   1.534 +        args.rval().setObject(*nobj);
   1.535 +        return true;
   1.536 +    }
   1.537 +
   1.538 +    static bool
   1.539 +    fun_subarray(JSContext *cx, unsigned argc, Value *vp)
   1.540 +    {
   1.541 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.542 +        return CallNonGenericMethod<ThisTypedArrayObject::IsThisClass,
   1.543 +                                    ThisTypedArrayObject::fun_subarray_impl>(cx, args);
   1.544 +    }
   1.545 +
   1.546 +    /* move(begin, end, dest) */
   1.547 +    static bool
   1.548 +    fun_move_impl(JSContext *cx, CallArgs args)
   1.549 +    {
   1.550 +        JS_ASSERT(IsThisClass(args.thisv()));
   1.551 +        Rooted<TypedArrayObject*> tarray(cx, &args.thisv().toObject().as<TypedArrayObject>());
   1.552 +
   1.553 +        if (args.length() < 3) {
   1.554 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.555 +            return false;
   1.556 +        }
   1.557 +
   1.558 +        uint32_t srcBegin;
   1.559 +        uint32_t srcEnd;
   1.560 +        uint32_t dest;
   1.561 +
   1.562 +        uint32_t originalLength = tarray->length();
   1.563 +        if (!ToClampedIndex(cx, args[0], originalLength, &srcBegin) ||
   1.564 +            !ToClampedIndex(cx, args[1], originalLength, &srcEnd) ||
   1.565 +            !ToClampedIndex(cx, args[2], originalLength, &dest))
   1.566 +        {
   1.567 +            return false;
   1.568 +        }
   1.569 +
   1.570 +        if (srcBegin > srcEnd) {
   1.571 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
   1.572 +            return false;
   1.573 +        }
   1.574 +
   1.575 +        uint32_t lengthDuringMove = tarray->length(); // beware ToClampedIndex
   1.576 +        uint32_t nelts = srcEnd - srcBegin;
   1.577 +
   1.578 +        MOZ_ASSERT(dest <= INT32_MAX, "size limited to 2**31");
   1.579 +        MOZ_ASSERT(nelts <= INT32_MAX, "size limited to 2**31");
   1.580 +        if (dest + nelts > lengthDuringMove || srcEnd > lengthDuringMove) {
   1.581 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.582 +            return false;
   1.583 +        }
   1.584 +
   1.585 +        uint32_t byteDest = dest * sizeof(NativeType);
   1.586 +        uint32_t byteSrc = srcBegin * sizeof(NativeType);
   1.587 +        uint32_t byteSize = nelts * sizeof(NativeType);
   1.588 +
   1.589 +#ifdef DEBUG
   1.590 +        uint32_t viewByteLength = tarray->byteLength();
   1.591 +        JS_ASSERT(byteDest <= viewByteLength);
   1.592 +        JS_ASSERT(byteSrc <= viewByteLength);
   1.593 +        JS_ASSERT(byteDest + byteSize <= viewByteLength);
   1.594 +        JS_ASSERT(byteSrc + byteSize <= viewByteLength);
   1.595 +
   1.596 +        // Should not overflow because size is limited to 2^31
   1.597 +        JS_ASSERT(byteDest + byteSize >= byteDest);
   1.598 +        JS_ASSERT(byteSrc + byteSize >= byteSrc);
   1.599 +#endif
   1.600 +
   1.601 +        uint8_t *data = static_cast<uint8_t*>(tarray->viewData());
   1.602 +        memmove(&data[byteDest], &data[byteSrc], byteSize);
   1.603 +        args.rval().setUndefined();
   1.604 +        return true;
   1.605 +    }
   1.606 +
   1.607 +    static bool
   1.608 +    fun_move(JSContext *cx, unsigned argc, Value *vp)
   1.609 +    {
   1.610 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.611 +        return CallNonGenericMethod<ThisTypedArrayObject::IsThisClass,
   1.612 +                                    ThisTypedArrayObject::fun_move_impl>(cx, args);
   1.613 +    }
   1.614 +
   1.615 +    /* set(array[, offset]) */
   1.616 +    static bool
   1.617 +    fun_set_impl(JSContext *cx, CallArgs args)
   1.618 +    {
   1.619 +        JS_ASSERT(IsThisClass(args.thisv()));
   1.620 +        Rooted<TypedArrayObject*> tarray(cx, &args.thisv().toObject().as<TypedArrayObject>());
   1.621 +
   1.622 +        // first arg must be either a typed array or a JS array
   1.623 +        if (args.length() == 0 || !args[0].isObject()) {
   1.624 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.625 +            return false;
   1.626 +        }
   1.627 +
   1.628 +        int32_t offset = 0;
   1.629 +        if (args.length() > 1) {
   1.630 +            if (!ToInt32(cx, args[1], &offset))
   1.631 +                return false;
   1.632 +
   1.633 +            if (offset < 0 || uint32_t(offset) > tarray->length()) {
   1.634 +                // the given offset is bogus
   1.635 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
   1.636 +                                     JSMSG_TYPED_ARRAY_BAD_INDEX, "2");
   1.637 +                return false;
   1.638 +            }
   1.639 +        }
   1.640 +
   1.641 +        if (!args[0].isObject()) {
   1.642 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.643 +            return false;
   1.644 +        }
   1.645 +
   1.646 +        RootedObject arg0(cx, args[0].toObjectOrNull());
   1.647 +        if (arg0->is<TypedArrayObject>()) {
   1.648 +            if (arg0->as<TypedArrayObject>().length() > tarray->length() - offset) {
   1.649 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
   1.650 +                return false;
   1.651 +            }
   1.652 +
   1.653 +            if (!copyFromTypedArray(cx, tarray, arg0, offset))
   1.654 +                return false;
   1.655 +        } else {
   1.656 +            uint32_t len;
   1.657 +            if (!GetLengthProperty(cx, arg0, &len))
   1.658 +                return false;
   1.659 +
   1.660 +            if (uint32_t(offset) > tarray->length() || len > tarray->length() - offset) {
   1.661 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_ARRAY_LENGTH);
   1.662 +                return false;
   1.663 +            }
   1.664 +
   1.665 +            if (!copyFromArray(cx, tarray, arg0, len, offset))
   1.666 +                return false;
   1.667 +        }
   1.668 +
   1.669 +        args.rval().setUndefined();
   1.670 +        return true;
   1.671 +    }
   1.672 +
   1.673 +    static bool
   1.674 +    fun_set(JSContext *cx, unsigned argc, Value *vp)
   1.675 +    {
   1.676 +        CallArgs args = CallArgsFromVp(argc, vp);
   1.677 +        return CallNonGenericMethod<ThisTypedArrayObject::IsThisClass,
   1.678 +                                    ThisTypedArrayObject::fun_set_impl>(cx, args);
   1.679 +    }
   1.680 +
   1.681 +  public:
   1.682 +    static JSObject *
   1.683 +    fromBuffer(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, int32_t lengthInt,
   1.684 +               HandleObject proto)
   1.685 +    {
   1.686 +        if (!ObjectClassIs(bufobj, ESClass_ArrayBuffer, cx)) {
   1.687 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.688 +            return nullptr; // must be arrayBuffer
   1.689 +        }
   1.690 +
   1.691 +        JS_ASSERT(IsArrayBuffer(bufobj) || bufobj->is<ProxyObject>());
   1.692 +        if (bufobj->is<ProxyObject>()) {
   1.693 +            /*
   1.694 +             * Normally, NonGenericMethodGuard handles the case of transparent
   1.695 +             * wrappers. However, we have a peculiar situation: we want to
   1.696 +             * construct the new typed array in the compartment of the buffer,
   1.697 +             * so that the typed array can point directly at their buffer's
   1.698 +             * data without crossing compartment boundaries. So we use the
   1.699 +             * machinery underlying NonGenericMethodGuard directly to proxy the
   1.700 +             * native call. We will end up with a wrapper in the origin
   1.701 +             * compartment for a view in the target compartment referencing the
   1.702 +             * ArrayBufferObject in that same compartment.
   1.703 +             */
   1.704 +            JSObject *wrapped = CheckedUnwrap(bufobj);
   1.705 +            if (!wrapped) {
   1.706 +                JS_ReportError(cx, "Permission denied to access object");
   1.707 +                return nullptr;
   1.708 +            }
   1.709 +            if (IsArrayBuffer(wrapped)) {
   1.710 +                /*
   1.711 +                 * And for even more fun, the new view's prototype should be
   1.712 +                 * set to the origin compartment's prototype object, not the
   1.713 +                 * target's (specifically, the actual view in the target
   1.714 +                 * compartment will use as its prototype a wrapper around the
   1.715 +                 * origin compartment's view.prototype object).
   1.716 +                 *
   1.717 +                 * Rather than hack some crazy solution together, implement
   1.718 +                 * this all using a private helper function, created when
   1.719 +                 * ArrayBufferObject was initialized and cached in the global.
   1.720 +                 * This reuses all the existing cross-compartment crazy so we
   1.721 +                 * don't have to do anything *uniquely* crazy here.
   1.722 +                 */
   1.723 +
   1.724 +                Rooted<JSObject*> proto(cx);
   1.725 +                if (!GetBuiltinPrototype(cx, JSCLASS_CACHED_PROTO_KEY(instanceClass()), &proto))
   1.726 +                    return nullptr;
   1.727 +
   1.728 +                InvokeArgs args(cx);
   1.729 +                if (!args.init(3))
   1.730 +                    return nullptr;
   1.731 +
   1.732 +                args.setCallee(cx->compartment()->maybeGlobal()->createArrayFromBuffer<NativeType>());
   1.733 +                args.setThis(ObjectValue(*bufobj));
   1.734 +                args[0].setNumber(byteOffset);
   1.735 +                args[1].setInt32(lengthInt);
   1.736 +                args[2].setObject(*proto);
   1.737 +
   1.738 +                if (!Invoke(cx, args))
   1.739 +                    return nullptr;
   1.740 +                return &args.rval().toObject();
   1.741 +            }
   1.742 +        }
   1.743 +
   1.744 +        if (!IsArrayBuffer(bufobj)) {
   1.745 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.746 +            return nullptr; // must be arrayBuffer
   1.747 +        }
   1.748 +
   1.749 +        Rooted<ArrayBufferObject *> buffer(cx, &AsArrayBuffer(bufobj));
   1.750 +
   1.751 +        if (byteOffset > buffer->byteLength() || byteOffset % sizeof(NativeType) != 0) {
   1.752 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.753 +            return nullptr; // invalid byteOffset
   1.754 +        }
   1.755 +
   1.756 +        uint32_t len;
   1.757 +        if (lengthInt == -1) {
   1.758 +            len = (buffer->byteLength() - byteOffset) / sizeof(NativeType);
   1.759 +            if (len * sizeof(NativeType) != buffer->byteLength() - byteOffset) {
   1.760 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
   1.761 +                                     JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.762 +                return nullptr; // given byte array doesn't map exactly to sizeof(NativeType) * N
   1.763 +            }
   1.764 +        } else {
   1.765 +            len = uint32_t(lengthInt);
   1.766 +        }
   1.767 +
   1.768 +        // Go slowly and check for overflow.
   1.769 +        uint32_t arrayByteLength = len * sizeof(NativeType);
   1.770 +        if (len >= INT32_MAX / sizeof(NativeType) || byteOffset >= INT32_MAX - arrayByteLength) {
   1.771 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.772 +            return nullptr; // overflow when calculating byteOffset + len * sizeof(NativeType)
   1.773 +        }
   1.774 +
   1.775 +        if (arrayByteLength + byteOffset > buffer->byteLength()) {
   1.776 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
   1.777 +            return nullptr; // byteOffset + len is too big for the arraybuffer
   1.778 +        }
   1.779 +
   1.780 +        return makeInstance(cx, buffer, byteOffset, len, proto);
   1.781 +    }
   1.782 +
   1.783 +    static bool
   1.784 +    maybeCreateArrayBuffer(JSContext *cx, uint32_t nelements, MutableHandle<ArrayBufferObject *> buffer)
   1.785 +    {
   1.786 +        // Make sure that array elements evenly divide into the inline buffer's
   1.787 +        // size, for the test below.
   1.788 +        JS_STATIC_ASSERT((INLINE_BUFFER_LIMIT / sizeof(NativeType)) * sizeof(NativeType) == INLINE_BUFFER_LIMIT);
   1.789 +
   1.790 +        if (nelements <= INLINE_BUFFER_LIMIT / sizeof(NativeType)) {
   1.791 +            // The array's data can be inline, and the buffer created lazily.
   1.792 +            return true;
   1.793 +        }
   1.794 +
   1.795 +        if (nelements >= INT32_MAX / sizeof(NativeType)) {
   1.796 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
   1.797 +                                 JSMSG_NEED_DIET, "size and count");
   1.798 +            return false;
   1.799 +        }
   1.800 +
   1.801 +        buffer.set(ArrayBufferObject::create(cx, nelements * sizeof(NativeType)));
   1.802 +        return !!buffer;
   1.803 +    }
   1.804 +
   1.805 +    static JSObject *
   1.806 +    fromLength(JSContext *cx, uint32_t nelements)
   1.807 +    {
   1.808 +        Rooted<ArrayBufferObject *> buffer(cx);
   1.809 +        if (!maybeCreateArrayBuffer(cx, nelements, &buffer))
   1.810 +            return nullptr;
   1.811 +        return makeInstance(cx, buffer, 0, nelements);
   1.812 +    }
   1.813 +
   1.814 +    static JSObject *
   1.815 +    fromArray(JSContext *cx, HandleObject other)
   1.816 +    {
   1.817 +        uint32_t len;
   1.818 +        if (other->is<TypedArrayObject>()) {
   1.819 +            len = other->as<TypedArrayObject>().length();
   1.820 +        } else if (!GetLengthProperty(cx, other, &len)) {
   1.821 +            return nullptr;
   1.822 +        }
   1.823 +
   1.824 +        Rooted<ArrayBufferObject *> buffer(cx);
   1.825 +        if (!maybeCreateArrayBuffer(cx, len, &buffer))
   1.826 +            return nullptr;
   1.827 +
   1.828 +        RootedObject obj(cx, makeInstance(cx, buffer, 0, len));
   1.829 +        if (!obj || !copyFromArray(cx, obj, other, len))
   1.830 +            return nullptr;
   1.831 +        return obj;
   1.832 +    }
   1.833 +
   1.834 +    static const NativeType
   1.835 +    getIndex(JSObject *obj, uint32_t index)
   1.836 +    {
   1.837 +        TypedArrayObject &tarray = obj->as<TypedArrayObject>();
   1.838 +        MOZ_ASSERT(index < tarray.length());
   1.839 +        return static_cast<const NativeType*>(tarray.viewData())[index];
   1.840 +    }
   1.841 +
   1.842 +    static void
   1.843 +    setIndex(TypedArrayObject &tarray, uint32_t index, NativeType val)
   1.844 +    {
   1.845 +        MOZ_ASSERT(index < tarray.length());
   1.846 +        static_cast<NativeType*>(tarray.viewData())[index] = val;
   1.847 +    }
   1.848 +
   1.849 +    static Value getIndexValue(JSObject *tarray, uint32_t index);
   1.850 +
   1.851 +    static JSObject *
   1.852 +    createSubarray(JSContext *cx, HandleObject tarrayArg, uint32_t begin, uint32_t end)
   1.853 +    {
   1.854 +        Rooted<TypedArrayObject*> tarray(cx, &tarrayArg->as<TypedArrayObject>());
   1.855 +
   1.856 +        if (begin > tarray->length() || end > tarray->length() || begin > end) {
   1.857 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_INDEX);
   1.858 +            return nullptr;
   1.859 +        }
   1.860 +
   1.861 +        if (!ensureHasBuffer(cx, tarray))
   1.862 +            return nullptr;
   1.863 +
   1.864 +        Rooted<ArrayBufferObject *> bufobj(cx, tarray->buffer());
   1.865 +        JS_ASSERT(bufobj);
   1.866 +
   1.867 +        uint32_t length = end - begin;
   1.868 +
   1.869 +        JS_ASSERT(begin < UINT32_MAX / sizeof(NativeType));
   1.870 +        uint32_t arrayByteOffset = tarray->byteOffset();
   1.871 +        JS_ASSERT(UINT32_MAX - begin * sizeof(NativeType) >= arrayByteOffset);
   1.872 +        uint32_t byteOffset = arrayByteOffset + begin * sizeof(NativeType);
   1.873 +
   1.874 +        return makeInstance(cx, bufobj, byteOffset, length);
   1.875 +    }
   1.876 +
   1.877 +  protected:
   1.878 +    static NativeType
   1.879 +    doubleToNative(double d)
   1.880 +    {
   1.881 +        if (TypeIsFloatingPoint<NativeType>()) {
   1.882 +#ifdef JS_MORE_DETERMINISTIC
   1.883 +            // The JS spec doesn't distinguish among different NaN values, and
   1.884 +            // it deliberately doesn't specify the bit pattern written to a
   1.885 +            // typed array when NaN is written into it.  This bit-pattern
   1.886 +            // inconsistency could confuse deterministic testing, so always
   1.887 +            // canonicalize NaN values in more-deterministic builds.
   1.888 +            d = CanonicalizeNaN(d);
   1.889 +#endif
   1.890 +            return NativeType(d);
   1.891 +        }
   1.892 +        if (MOZ_UNLIKELY(IsNaN(d)))
   1.893 +            return NativeType(0);
   1.894 +        if (TypeIsUnsigned<NativeType>())
   1.895 +            return NativeType(ToUint32(d));
   1.896 +        return NativeType(ToInt32(d));
   1.897 +    }
   1.898 +
   1.899 +    static bool
   1.900 +    canConvertInfallibly(const Value &v)
   1.901 +    {
   1.902 +        return v.isNumber() || v.isBoolean() || v.isNull() || v.isUndefined();
   1.903 +    }
   1.904 +
   1.905 +    static NativeType
   1.906 +    infallibleValueToNative(const Value &v)
   1.907 +    {
   1.908 +        if (v.isInt32())
   1.909 +            return v.toInt32();
   1.910 +        if (v.isDouble())
   1.911 +            return doubleToNative(v.toDouble());
   1.912 +        if (v.isBoolean())
   1.913 +            return v.toBoolean();
   1.914 +        if (v.isNull())
   1.915 +            return 0;
   1.916 +
   1.917 +        MOZ_ASSERT(v.isUndefined());
   1.918 +        return ArrayTypeIsFloatingPoint() ? NativeType(GenericNaN()) : NativeType(0);
   1.919 +    }
   1.920 +
   1.921 +    static bool
   1.922 +    valueToNative(JSContext *cx, const Value &v, NativeType *result)
   1.923 +    {
   1.924 +        MOZ_ASSERT(!v.isMagic());
   1.925 +
   1.926 +        if (MOZ_LIKELY(canConvertInfallibly(v))) {
   1.927 +            *result = infallibleValueToNative(v);
   1.928 +            return true;
   1.929 +        }
   1.930 +
   1.931 +        double d;
   1.932 +        MOZ_ASSERT(v.isString() || v.isObject());
   1.933 +        if (!(v.isString() ? StringToNumber(cx, v.toString(), &d) : ToNumber(cx, v, &d)))
   1.934 +            return false;
   1.935 +
   1.936 +        *result = doubleToNative(d);
   1.937 +        return true;
   1.938 +    }
   1.939 +
   1.940 +    static bool
   1.941 +    copyFromArray(JSContext *cx, HandleObject thisTypedArrayObj,
   1.942 +                  HandleObject source, uint32_t len, uint32_t offset = 0)
   1.943 +    {
   1.944 +        Rooted<TypedArrayObject*> thisTypedArray(cx, &thisTypedArrayObj->as<TypedArrayObject>());
   1.945 +        JS_ASSERT(offset <= thisTypedArray->length());
   1.946 +        JS_ASSERT(len <= thisTypedArray->length() - offset);
   1.947 +        if (source->is<TypedArrayObject>())
   1.948 +            return copyFromTypedArray(cx, thisTypedArray, source, offset);
   1.949 +
   1.950 +        uint32_t i = 0;
   1.951 +        if (source->isNative()) {
   1.952 +            // Attempt fast-path infallible conversion of dense elements up to
   1.953 +            // the first potentially side-effectful lookup or conversion.
   1.954 +            uint32_t bound = Min(source->getDenseInitializedLength(), len);
   1.955 +
   1.956 +            NativeType *dest = static_cast<NativeType*>(thisTypedArray->viewData()) + offset;
   1.957 +
   1.958 +            const Value *srcValues = source->getDenseElements();
   1.959 +            for (; i < bound; i++) {
   1.960 +                // Note: holes don't convert infallibly.
   1.961 +                if (!canConvertInfallibly(srcValues[i]))
   1.962 +                    break;
   1.963 +                dest[i] = infallibleValueToNative(srcValues[i]);
   1.964 +            }
   1.965 +            if (i == len)
   1.966 +                return true;
   1.967 +        }
   1.968 +
   1.969 +        // Convert and copy any remaining elements generically.
   1.970 +        RootedValue v(cx);
   1.971 +        for (; i < len; i++) {
   1.972 +            if (!JSObject::getElement(cx, source, source, i, &v))
   1.973 +                return false;
   1.974 +
   1.975 +            NativeType n;
   1.976 +            if (!valueToNative(cx, v, &n))
   1.977 +                return false;
   1.978 +
   1.979 +            len = Min(len, thisTypedArray->length());
   1.980 +            if (i >= len)
   1.981 +                break;
   1.982 +
   1.983 +            // Compute every iteration in case getElement acts wacky.
   1.984 +            void *data = thisTypedArray->viewData();
   1.985 +            static_cast<NativeType*>(data)[offset + i] = n;
   1.986 +        }
   1.987 +
   1.988 +        return true;
   1.989 +    }
   1.990 +
   1.991 +    static bool
   1.992 +    copyFromTypedArray(JSContext *cx, JSObject *thisTypedArrayObj, JSObject *tarrayObj,
   1.993 +                       uint32_t offset)
   1.994 +    {
   1.995 +        TypedArrayObject *thisTypedArray = &thisTypedArrayObj->as<TypedArrayObject>();
   1.996 +        TypedArrayObject *tarray = &tarrayObj->as<TypedArrayObject>();
   1.997 +        JS_ASSERT(offset <= thisTypedArray->length());
   1.998 +        JS_ASSERT(tarray->length() <= thisTypedArray->length() - offset);
   1.999 +        if (tarray->buffer() == thisTypedArray->buffer())
  1.1000 +            return copyFromWithOverlap(cx, thisTypedArray, tarray, offset);
  1.1001 +
  1.1002 +        NativeType *dest = static_cast<NativeType*>(thisTypedArray->viewData()) + offset;
  1.1003 +
  1.1004 +        if (tarray->type() == thisTypedArray->type()) {
  1.1005 +            js_memcpy(dest, tarray->viewData(), tarray->byteLength());
  1.1006 +            return true;
  1.1007 +        }
  1.1008 +
  1.1009 +        unsigned srclen = tarray->length();
  1.1010 +        switch (tarray->type()) {
  1.1011 +          case ScalarTypeDescr::TYPE_INT8: {
  1.1012 +            int8_t *src = static_cast<int8_t*>(tarray->viewData());
  1.1013 +            for (unsigned i = 0; i < srclen; ++i)
  1.1014 +                *dest++ = NativeType(*src++);
  1.1015 +            break;
  1.1016 +          }
  1.1017 +          case ScalarTypeDescr::TYPE_UINT8:
  1.1018 +          case ScalarTypeDescr::TYPE_UINT8_CLAMPED: {
  1.1019 +            uint8_t *src = static_cast<uint8_t*>(tarray->viewData());
  1.1020 +            for (unsigned i = 0; i < srclen; ++i)
  1.1021 +                *dest++ = NativeType(*src++);
  1.1022 +            break;
  1.1023 +          }
  1.1024 +          case ScalarTypeDescr::TYPE_INT16: {
  1.1025 +            int16_t *src = static_cast<int16_t*>(tarray->viewData());
  1.1026 +            for (unsigned i = 0; i < srclen; ++i)
  1.1027 +                *dest++ = NativeType(*src++);
  1.1028 +            break;
  1.1029 +          }
  1.1030 +          case ScalarTypeDescr::TYPE_UINT16: {
  1.1031 +            uint16_t *src = static_cast<uint16_t*>(tarray->viewData());
  1.1032 +            for (unsigned i = 0; i < srclen; ++i)
  1.1033 +                *dest++ = NativeType(*src++);
  1.1034 +            break;
  1.1035 +          }
  1.1036 +          case ScalarTypeDescr::TYPE_INT32: {
  1.1037 +            int32_t *src = static_cast<int32_t*>(tarray->viewData());
  1.1038 +            for (unsigned i = 0; i < srclen; ++i)
  1.1039 +                *dest++ = NativeType(*src++);
  1.1040 +            break;
  1.1041 +          }
  1.1042 +          case ScalarTypeDescr::TYPE_UINT32: {
  1.1043 +            uint32_t *src = static_cast<uint32_t*>(tarray->viewData());
  1.1044 +            for (unsigned i = 0; i < srclen; ++i)
  1.1045 +                *dest++ = NativeType(*src++);
  1.1046 +            break;
  1.1047 +          }
  1.1048 +          case ScalarTypeDescr::TYPE_FLOAT32: {
  1.1049 +            float *src = static_cast<float*>(tarray->viewData());
  1.1050 +            for (unsigned i = 0; i < srclen; ++i)
  1.1051 +                *dest++ = NativeType(*src++);
  1.1052 +            break;
  1.1053 +          }
  1.1054 +          case ScalarTypeDescr::TYPE_FLOAT64: {
  1.1055 +            double *src = static_cast<double*>(tarray->viewData());
  1.1056 +            for (unsigned i = 0; i < srclen; ++i)
  1.1057 +                *dest++ = NativeType(*src++);
  1.1058 +            break;
  1.1059 +          }
  1.1060 +          default:
  1.1061 +            MOZ_ASSUME_UNREACHABLE("copyFrom with a TypedArrayObject of unknown type");
  1.1062 +        }
  1.1063 +
  1.1064 +        return true;
  1.1065 +    }
  1.1066 +
  1.1067 +    static bool
  1.1068 +    copyFromWithOverlap(JSContext *cx, JSObject *selfObj, JSObject *tarrayObj, uint32_t offset)
  1.1069 +    {
  1.1070 +        TypedArrayObject *self = &selfObj->as<TypedArrayObject>();
  1.1071 +        TypedArrayObject *tarray = &tarrayObj->as<TypedArrayObject>();
  1.1072 +
  1.1073 +        JS_ASSERT(offset <= self->length());
  1.1074 +
  1.1075 +        NativeType *dest = static_cast<NativeType*>(self->viewData()) + offset;
  1.1076 +        uint32_t byteLength = tarray->byteLength();
  1.1077 +
  1.1078 +        if (tarray->type() == self->type()) {
  1.1079 +            memmove(dest, tarray->viewData(), byteLength);
  1.1080 +            return true;
  1.1081 +        }
  1.1082 +
  1.1083 +        // We have to make a copy of the source array here, since
  1.1084 +        // there's overlap, and we have to convert types.
  1.1085 +        void *srcbuf = cx->malloc_(byteLength);
  1.1086 +        if (!srcbuf)
  1.1087 +            return false;
  1.1088 +        js_memcpy(srcbuf, tarray->viewData(), byteLength);
  1.1089 +
  1.1090 +        uint32_t len = tarray->length();
  1.1091 +        switch (tarray->type()) {
  1.1092 +          case ScalarTypeDescr::TYPE_INT8: {
  1.1093 +            int8_t *src = (int8_t*) srcbuf;
  1.1094 +            for (unsigned i = 0; i < len; ++i)
  1.1095 +                *dest++ = NativeType(*src++);
  1.1096 +            break;
  1.1097 +          }
  1.1098 +          case ScalarTypeDescr::TYPE_UINT8:
  1.1099 +          case ScalarTypeDescr::TYPE_UINT8_CLAMPED: {
  1.1100 +            uint8_t *src = (uint8_t*) srcbuf;
  1.1101 +            for (unsigned i = 0; i < len; ++i)
  1.1102 +                *dest++ = NativeType(*src++);
  1.1103 +            break;
  1.1104 +          }
  1.1105 +          case ScalarTypeDescr::TYPE_INT16: {
  1.1106 +            int16_t *src = (int16_t*) srcbuf;
  1.1107 +            for (unsigned i = 0; i < len; ++i)
  1.1108 +                *dest++ = NativeType(*src++);
  1.1109 +            break;
  1.1110 +          }
  1.1111 +          case ScalarTypeDescr::TYPE_UINT16: {
  1.1112 +            uint16_t *src = (uint16_t*) srcbuf;
  1.1113 +            for (unsigned i = 0; i < len; ++i)
  1.1114 +                *dest++ = NativeType(*src++);
  1.1115 +            break;
  1.1116 +          }
  1.1117 +          case ScalarTypeDescr::TYPE_INT32: {
  1.1118 +            int32_t *src = (int32_t*) srcbuf;
  1.1119 +            for (unsigned i = 0; i < len; ++i)
  1.1120 +                *dest++ = NativeType(*src++);
  1.1121 +            break;
  1.1122 +          }
  1.1123 +          case ScalarTypeDescr::TYPE_UINT32: {
  1.1124 +            uint32_t *src = (uint32_t*) srcbuf;
  1.1125 +            for (unsigned i = 0; i < len; ++i)
  1.1126 +                *dest++ = NativeType(*src++);
  1.1127 +            break;
  1.1128 +          }
  1.1129 +          case ScalarTypeDescr::TYPE_FLOAT32: {
  1.1130 +            float *src = (float*) srcbuf;
  1.1131 +            for (unsigned i = 0; i < len; ++i)
  1.1132 +                *dest++ = NativeType(*src++);
  1.1133 +            break;
  1.1134 +          }
  1.1135 +          case ScalarTypeDescr::TYPE_FLOAT64: {
  1.1136 +            double *src = (double*) srcbuf;
  1.1137 +            for (unsigned i = 0; i < len; ++i)
  1.1138 +                *dest++ = NativeType(*src++);
  1.1139 +            break;
  1.1140 +          }
  1.1141 +          default:
  1.1142 +            MOZ_ASSUME_UNREACHABLE("copyFromWithOverlap with a TypedArrayObject of unknown type");
  1.1143 +        }
  1.1144 +
  1.1145 +        js_free(srcbuf);
  1.1146 +        return true;
  1.1147 +    }
  1.1148 +};
  1.1149 +
  1.1150 +class Int8ArrayObject : public TypedArrayObjectTemplate<int8_t> {
  1.1151 +  public:
  1.1152 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT8 };
  1.1153 +    static const JSProtoKey key = JSProto_Int8Array;
  1.1154 +    static const JSFunctionSpec jsfuncs[];
  1.1155 +};
  1.1156 +class Uint8ArrayObject : public TypedArrayObjectTemplate<uint8_t> {
  1.1157 +  public:
  1.1158 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8 };
  1.1159 +    static const JSProtoKey key = JSProto_Uint8Array;
  1.1160 +    static const JSFunctionSpec jsfuncs[];
  1.1161 +};
  1.1162 +class Int16ArrayObject : public TypedArrayObjectTemplate<int16_t> {
  1.1163 +  public:
  1.1164 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT16 };
  1.1165 +    static const JSProtoKey key = JSProto_Int16Array;
  1.1166 +    static const JSFunctionSpec jsfuncs[];
  1.1167 +};
  1.1168 +class Uint16ArrayObject : public TypedArrayObjectTemplate<uint16_t> {
  1.1169 +  public:
  1.1170 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT16 };
  1.1171 +    static const JSProtoKey key = JSProto_Uint16Array;
  1.1172 +    static const JSFunctionSpec jsfuncs[];
  1.1173 +};
  1.1174 +class Int32ArrayObject : public TypedArrayObjectTemplate<int32_t> {
  1.1175 +  public:
  1.1176 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT32 };
  1.1177 +    static const JSProtoKey key = JSProto_Int32Array;
  1.1178 +    static const JSFunctionSpec jsfuncs[];
  1.1179 +};
  1.1180 +class Uint32ArrayObject : public TypedArrayObjectTemplate<uint32_t> {
  1.1181 +  public:
  1.1182 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT32 };
  1.1183 +    static const JSProtoKey key = JSProto_Uint32Array;
  1.1184 +    static const JSFunctionSpec jsfuncs[];
  1.1185 +};
  1.1186 +class Float32ArrayObject : public TypedArrayObjectTemplate<float> {
  1.1187 +  public:
  1.1188 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT32 };
  1.1189 +    static const JSProtoKey key = JSProto_Float32Array;
  1.1190 +    static const JSFunctionSpec jsfuncs[];
  1.1191 +};
  1.1192 +class Float64ArrayObject : public TypedArrayObjectTemplate<double> {
  1.1193 +  public:
  1.1194 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT64 };
  1.1195 +    static const JSProtoKey key = JSProto_Float64Array;
  1.1196 +    static const JSFunctionSpec jsfuncs[];
  1.1197 +};
  1.1198 +class Uint8ClampedArrayObject : public TypedArrayObjectTemplate<uint8_clamped> {
  1.1199 +  public:
  1.1200 +    enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8_CLAMPED };
  1.1201 +    static const JSProtoKey key = JSProto_Uint8ClampedArray;
  1.1202 +    static const JSFunctionSpec jsfuncs[];
  1.1203 +};
  1.1204 +
  1.1205 +} /* anonymous namespace */
  1.1206 +
  1.1207 +template<typename T>
  1.1208 +bool
  1.1209 +ArrayBufferObject::createTypedArrayFromBufferImpl(JSContext *cx, CallArgs args)
  1.1210 +{
  1.1211 +    typedef TypedArrayObjectTemplate<T> ArrayType;
  1.1212 +    JS_ASSERT(IsArrayBuffer(args.thisv()));
  1.1213 +    JS_ASSERT(args.length() == 3);
  1.1214 +
  1.1215 +    Rooted<JSObject*> buffer(cx, &args.thisv().toObject());
  1.1216 +    Rooted<JSObject*> proto(cx, &args[2].toObject());
  1.1217 +
  1.1218 +    Rooted<JSObject*> obj(cx);
  1.1219 +    double byteOffset = args[0].toNumber();
  1.1220 +    MOZ_ASSERT(0 <= byteOffset);
  1.1221 +    MOZ_ASSERT(byteOffset <= UINT32_MAX);
  1.1222 +    MOZ_ASSERT(byteOffset == uint32_t(byteOffset));
  1.1223 +    obj = ArrayType::fromBuffer(cx, buffer, uint32_t(byteOffset), args[1].toInt32(), proto);
  1.1224 +    if (!obj)
  1.1225 +        return false;
  1.1226 +    args.rval().setObject(*obj);
  1.1227 +    return true;
  1.1228 +}
  1.1229 +
  1.1230 +template<typename T>
  1.1231 +bool
  1.1232 +ArrayBufferObject::createTypedArrayFromBuffer(JSContext *cx, unsigned argc, Value *vp)
  1.1233 +{
  1.1234 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1235 +    return CallNonGenericMethod<IsArrayBuffer, createTypedArrayFromBufferImpl<T> >(cx, args);
  1.1236 +}
  1.1237 +
  1.1238 +// this default implementation is only valid for integer types
  1.1239 +// less than 32-bits in size.
  1.1240 +template<typename NativeType>
  1.1241 +Value
  1.1242 +TypedArrayObjectTemplate<NativeType>::getIndexValue(JSObject *tarray, uint32_t index)
  1.1243 +{
  1.1244 +    JS_STATIC_ASSERT(sizeof(NativeType) < 4);
  1.1245 +
  1.1246 +    return Int32Value(getIndex(tarray, index));
  1.1247 +}
  1.1248 +
  1.1249 +namespace {
  1.1250 +
  1.1251 +// and we need to specialize for 32-bit integers and floats
  1.1252 +template<>
  1.1253 +Value
  1.1254 +TypedArrayObjectTemplate<int32_t>::getIndexValue(JSObject *tarray, uint32_t index)
  1.1255 +{
  1.1256 +    return Int32Value(getIndex(tarray, index));
  1.1257 +}
  1.1258 +
  1.1259 +template<>
  1.1260 +Value
  1.1261 +TypedArrayObjectTemplate<uint32_t>::getIndexValue(JSObject *tarray, uint32_t index)
  1.1262 +{
  1.1263 +    uint32_t val = getIndex(tarray, index);
  1.1264 +    return NumberValue(val);
  1.1265 +}
  1.1266 +
  1.1267 +template<>
  1.1268 +Value
  1.1269 +TypedArrayObjectTemplate<float>::getIndexValue(JSObject *tarray, uint32_t index)
  1.1270 +{
  1.1271 +    float val = getIndex(tarray, index);
  1.1272 +    double dval = val;
  1.1273 +
  1.1274 +    /*
  1.1275 +     * Doubles in typed arrays could be typed-punned arrays of integers. This
  1.1276 +     * could allow user code to break the engine-wide invariant that only
  1.1277 +     * canonical nans are stored into jsvals, which means user code could
  1.1278 +     * confuse the engine into interpreting a double-typed jsval as an
  1.1279 +     * object-typed jsval.
  1.1280 +     *
  1.1281 +     * This could be removed for platforms/compilers known to convert a 32-bit
  1.1282 +     * non-canonical nan to a 64-bit canonical nan.
  1.1283 +     */
  1.1284 +    return DoubleValue(CanonicalizeNaN(dval));
  1.1285 +}
  1.1286 +
  1.1287 +template<>
  1.1288 +Value
  1.1289 +TypedArrayObjectTemplate<double>::getIndexValue(JSObject *tarray, uint32_t index)
  1.1290 +{
  1.1291 +    double val = getIndex(tarray, index);
  1.1292 +
  1.1293 +    /*
  1.1294 +     * Doubles in typed arrays could be typed-punned arrays of integers. This
  1.1295 +     * could allow user code to break the engine-wide invariant that only
  1.1296 +     * canonical nans are stored into jsvals, which means user code could
  1.1297 +     * confuse the engine into interpreting a double-typed jsval as an
  1.1298 +     * object-typed jsval.
  1.1299 +     */
  1.1300 +    return DoubleValue(CanonicalizeNaN(val));
  1.1301 +}
  1.1302 +
  1.1303 +} /* anonymous namespace */
  1.1304 +
  1.1305 +static NewObjectKind
  1.1306 +DataViewNewObjectKind(JSContext *cx, uint32_t byteLength, JSObject *proto)
  1.1307 +{
  1.1308 +    if (!proto && byteLength >= TypedArrayObject::SINGLETON_TYPE_BYTE_LENGTH)
  1.1309 +        return SingletonObject;
  1.1310 +    jsbytecode *pc;
  1.1311 +    JSScript *script = cx->currentScript(&pc);
  1.1312 +    if (!script)
  1.1313 +        return GenericObject;
  1.1314 +    return types::UseNewTypeForInitializer(script, pc, &DataViewObject::class_);
  1.1315 +}
  1.1316 +
  1.1317 +inline DataViewObject *
  1.1318 +DataViewObject::create(JSContext *cx, uint32_t byteOffset, uint32_t byteLength,
  1.1319 +                       Handle<ArrayBufferObject*> arrayBuffer, JSObject *protoArg)
  1.1320 +{
  1.1321 +    JS_ASSERT(byteOffset <= INT32_MAX);
  1.1322 +    JS_ASSERT(byteLength <= INT32_MAX);
  1.1323 +
  1.1324 +    RootedObject proto(cx, protoArg);
  1.1325 +    RootedObject obj(cx);
  1.1326 +
  1.1327 +    // This is overflow-safe: 2 * INT32_MAX is still a valid uint32_t.
  1.1328 +    if (byteOffset + byteLength > arrayBuffer->byteLength()) {
  1.1329 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
  1.1330 +        return nullptr;
  1.1331 +
  1.1332 +    }
  1.1333 +
  1.1334 +    NewObjectKind newKind = DataViewNewObjectKind(cx, byteLength, proto);
  1.1335 +    obj = NewBuiltinClassInstance(cx, &class_, newKind);
  1.1336 +    if (!obj)
  1.1337 +        return nullptr;
  1.1338 +
  1.1339 +    if (proto) {
  1.1340 +        types::TypeObject *type = cx->getNewType(&class_, TaggedProto(proto));
  1.1341 +        if (!type)
  1.1342 +            return nullptr;
  1.1343 +        obj->setType(type);
  1.1344 +    } else if (byteLength >= TypedArrayObject::SINGLETON_TYPE_BYTE_LENGTH) {
  1.1345 +        JS_ASSERT(obj->hasSingletonType());
  1.1346 +    } else {
  1.1347 +        jsbytecode *pc;
  1.1348 +        RootedScript script(cx, cx->currentScript(&pc));
  1.1349 +        if (script) {
  1.1350 +            if (!types::SetInitializerObjectType(cx, script, pc, obj, newKind))
  1.1351 +                return nullptr;
  1.1352 +        }
  1.1353 +    }
  1.1354 +
  1.1355 +    DataViewObject &dvobj = obj->as<DataViewObject>();
  1.1356 +    dvobj.setFixedSlot(BYTEOFFSET_SLOT, Int32Value(byteOffset));
  1.1357 +    dvobj.setFixedSlot(BYTELENGTH_SLOT, Int32Value(byteLength));
  1.1358 +    dvobj.setFixedSlot(BUFFER_SLOT, ObjectValue(*arrayBuffer));
  1.1359 +    dvobj.setFixedSlot(NEXT_VIEW_SLOT, PrivateValue(nullptr));
  1.1360 +    InitArrayBufferViewDataPointer(&dvobj, arrayBuffer, byteOffset);
  1.1361 +    JS_ASSERT(byteOffset + byteLength <= arrayBuffer->byteLength());
  1.1362 +
  1.1363 +    // Verify that the private slot is at the expected place
  1.1364 +    JS_ASSERT(dvobj.numFixedSlots() == DATA_SLOT);
  1.1365 +
  1.1366 +    arrayBuffer->addView(&dvobj);
  1.1367 +
  1.1368 +    return &dvobj;
  1.1369 +}
  1.1370 +
  1.1371 +bool
  1.1372 +DataViewObject::construct(JSContext *cx, JSObject *bufobj, const CallArgs &args, HandleObject proto)
  1.1373 +{
  1.1374 +    if (!IsArrayBuffer(bufobj)) {
  1.1375 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_NOT_EXPECTED_TYPE,
  1.1376 +                             "DataView", "ArrayBuffer", bufobj->getClass()->name);
  1.1377 +        return false;
  1.1378 +    }
  1.1379 +
  1.1380 +    Rooted<ArrayBufferObject*> buffer(cx, &AsArrayBuffer(bufobj));
  1.1381 +    uint32_t bufferLength = buffer->byteLength();
  1.1382 +    uint32_t byteOffset = 0;
  1.1383 +    uint32_t byteLength = bufferLength;
  1.1384 +
  1.1385 +    if (args.length() > 1) {
  1.1386 +        if (!ToUint32(cx, args[1], &byteOffset))
  1.1387 +            return false;
  1.1388 +        if (byteOffset > INT32_MAX) {
  1.1389 +            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
  1.1390 +                                 JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
  1.1391 +            return false;
  1.1392 +        }
  1.1393 +
  1.1394 +        if (args.length() > 2) {
  1.1395 +            if (!ToUint32(cx, args[2], &byteLength))
  1.1396 +                return false;
  1.1397 +            if (byteLength > INT32_MAX) {
  1.1398 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
  1.1399 +                                     JSMSG_ARG_INDEX_OUT_OF_RANGE, "2");
  1.1400 +                return false;
  1.1401 +            }
  1.1402 +        } else {
  1.1403 +            if (byteOffset > bufferLength) {
  1.1404 +                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
  1.1405 +                                     JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
  1.1406 +                return false;
  1.1407 +            }
  1.1408 +
  1.1409 +            byteLength = bufferLength - byteOffset;
  1.1410 +        }
  1.1411 +    }
  1.1412 +
  1.1413 +    /* The sum of these cannot overflow a uint32_t */
  1.1414 +    JS_ASSERT(byteOffset <= INT32_MAX);
  1.1415 +    JS_ASSERT(byteLength <= INT32_MAX);
  1.1416 +
  1.1417 +    if (byteOffset + byteLength > bufferLength) {
  1.1418 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
  1.1419 +        return false;
  1.1420 +    }
  1.1421 +
  1.1422 +    JSObject *obj = DataViewObject::create(cx, byteOffset, byteLength, buffer, proto);
  1.1423 +    if (!obj)
  1.1424 +        return false;
  1.1425 +    args.rval().setObject(*obj);
  1.1426 +    return true;
  1.1427 +}
  1.1428 +
  1.1429 +bool
  1.1430 +DataViewObject::class_constructor(JSContext *cx, unsigned argc, Value *vp)
  1.1431 +{
  1.1432 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1433 +
  1.1434 +    RootedObject bufobj(cx);
  1.1435 +    if (!GetFirstArgumentAsObject(cx, args, "DataView constructor", &bufobj))
  1.1436 +        return false;
  1.1437 +
  1.1438 +    if (bufobj->is<WrapperObject>() && IsArrayBuffer(UncheckedUnwrap(bufobj))) {
  1.1439 +        Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
  1.1440 +        Rooted<JSObject*> proto(cx, global->getOrCreateDataViewPrototype(cx));
  1.1441 +        if (!proto)
  1.1442 +            return false;
  1.1443 +
  1.1444 +        InvokeArgs args2(cx);
  1.1445 +        if (!args2.init(args.length() + 1))
  1.1446 +            return false;
  1.1447 +        args2.setCallee(global->createDataViewForThis());
  1.1448 +        args2.setThis(ObjectValue(*bufobj));
  1.1449 +        PodCopy(args2.array(), args.array(), args.length());
  1.1450 +        args2[args.length()].setObject(*proto);
  1.1451 +        if (!Invoke(cx, args2))
  1.1452 +            return false;
  1.1453 +        args.rval().set(args2.rval());
  1.1454 +        return true;
  1.1455 +    }
  1.1456 +
  1.1457 +    return construct(cx, bufobj, args, NullPtr());
  1.1458 +}
  1.1459 +
  1.1460 +template <typename NativeType>
  1.1461 +/* static */ uint8_t *
  1.1462 +DataViewObject::getDataPointer(JSContext *cx, Handle<DataViewObject*> obj, uint32_t offset)
  1.1463 +{
  1.1464 +    const size_t TypeSize = sizeof(NativeType);
  1.1465 +    if (offset > UINT32_MAX - TypeSize || offset + TypeSize > obj->byteLength()) {
  1.1466 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
  1.1467 +        return nullptr;
  1.1468 +    }
  1.1469 +
  1.1470 +    return static_cast<uint8_t*>(obj->dataPointer()) + offset;
  1.1471 +}
  1.1472 +
  1.1473 +static inline bool
  1.1474 +needToSwapBytes(bool littleEndian)
  1.1475 +{
  1.1476 +#if IS_LITTLE_ENDIAN
  1.1477 +    return !littleEndian;
  1.1478 +#else
  1.1479 +    return littleEndian;
  1.1480 +#endif
  1.1481 +}
  1.1482 +
  1.1483 +static inline uint8_t
  1.1484 +swapBytes(uint8_t x)
  1.1485 +{
  1.1486 +    return x;
  1.1487 +}
  1.1488 +
  1.1489 +static inline uint16_t
  1.1490 +swapBytes(uint16_t x)
  1.1491 +{
  1.1492 +    return ((x & 0xff) << 8) | (x >> 8);
  1.1493 +}
  1.1494 +
  1.1495 +static inline uint32_t
  1.1496 +swapBytes(uint32_t x)
  1.1497 +{
  1.1498 +    return ((x & 0xff) << 24) |
  1.1499 +           ((x & 0xff00) << 8) |
  1.1500 +           ((x & 0xff0000) >> 8) |
  1.1501 +           ((x & 0xff000000) >> 24);
  1.1502 +}
  1.1503 +
  1.1504 +static inline uint64_t
  1.1505 +swapBytes(uint64_t x)
  1.1506 +{
  1.1507 +    uint32_t a = x & UINT32_MAX;
  1.1508 +    uint32_t b = x >> 32;
  1.1509 +    return (uint64_t(swapBytes(a)) << 32) | swapBytes(b);
  1.1510 +}
  1.1511 +
  1.1512 +template <typename DataType> struct DataToRepType { typedef DataType result; };
  1.1513 +template <> struct DataToRepType<int8_t>   { typedef uint8_t result; };
  1.1514 +template <> struct DataToRepType<uint8_t>  { typedef uint8_t result; };
  1.1515 +template <> struct DataToRepType<int16_t>  { typedef uint16_t result; };
  1.1516 +template <> struct DataToRepType<uint16_t> { typedef uint16_t result; };
  1.1517 +template <> struct DataToRepType<int32_t>  { typedef uint32_t result; };
  1.1518 +template <> struct DataToRepType<uint32_t> { typedef uint32_t result; };
  1.1519 +template <> struct DataToRepType<float>    { typedef uint32_t result; };
  1.1520 +template <> struct DataToRepType<double>   { typedef uint64_t result; };
  1.1521 +
  1.1522 +template <typename DataType>
  1.1523 +struct DataViewIO
  1.1524 +{
  1.1525 +    typedef typename DataToRepType<DataType>::result ReadWriteType;
  1.1526 +
  1.1527 +    static void fromBuffer(DataType *dest, const uint8_t *unalignedBuffer, bool wantSwap)
  1.1528 +    {
  1.1529 +        JS_ASSERT((reinterpret_cast<uintptr_t>(dest) & (Min<size_t>(MOZ_ALIGNOF(void*), sizeof(DataType)) - 1)) == 0);
  1.1530 +        memcpy((void *) dest, unalignedBuffer, sizeof(ReadWriteType));
  1.1531 +        if (wantSwap) {
  1.1532 +            ReadWriteType *rwDest = reinterpret_cast<ReadWriteType *>(dest);
  1.1533 +            *rwDest = swapBytes(*rwDest);
  1.1534 +        }
  1.1535 +    }
  1.1536 +
  1.1537 +    static void toBuffer(uint8_t *unalignedBuffer, const DataType *src, bool wantSwap)
  1.1538 +    {
  1.1539 +        JS_ASSERT((reinterpret_cast<uintptr_t>(src) & (Min<size_t>(MOZ_ALIGNOF(void*), sizeof(DataType)) - 1)) == 0);
  1.1540 +        ReadWriteType temp = *reinterpret_cast<const ReadWriteType *>(src);
  1.1541 +        if (wantSwap)
  1.1542 +            temp = swapBytes(temp);
  1.1543 +        memcpy(unalignedBuffer, (void *) &temp, sizeof(ReadWriteType));
  1.1544 +    }
  1.1545 +};
  1.1546 +
  1.1547 +template<typename NativeType>
  1.1548 +/* static */ bool
  1.1549 +DataViewObject::read(JSContext *cx, Handle<DataViewObject*> obj,
  1.1550 +                     CallArgs &args, NativeType *val, const char *method)
  1.1551 +{
  1.1552 +    if (args.length() < 1) {
  1.1553 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
  1.1554 +                             JSMSG_MORE_ARGS_NEEDED, method, "0", "s");
  1.1555 +        return false;
  1.1556 +    }
  1.1557 +
  1.1558 +    uint32_t offset;
  1.1559 +    if (!ToUint32(cx, args[0], &offset))
  1.1560 +        return false;
  1.1561 +
  1.1562 +    bool fromLittleEndian = args.length() >= 2 && ToBoolean(args[1]);
  1.1563 +
  1.1564 +    uint8_t *data = DataViewObject::getDataPointer<NativeType>(cx, obj, offset);
  1.1565 +    if (!data)
  1.1566 +        return false;
  1.1567 +
  1.1568 +    DataViewIO<NativeType>::fromBuffer(val, data, needToSwapBytes(fromLittleEndian));
  1.1569 +    return true;
  1.1570 +}
  1.1571 +
  1.1572 +template <typename NativeType>
  1.1573 +static inline bool
  1.1574 +WebIDLCast(JSContext *cx, HandleValue value, NativeType *out)
  1.1575 +{
  1.1576 +    int32_t temp;
  1.1577 +    if (!ToInt32(cx, value, &temp))
  1.1578 +        return false;
  1.1579 +    // Technically, the behavior of assigning an out of range value to a signed
  1.1580 +    // variable is undefined. In practice, compilers seem to do what we want
  1.1581 +    // without issuing any warnings.
  1.1582 +    *out = static_cast<NativeType>(temp);
  1.1583 +    return true;
  1.1584 +}
  1.1585 +
  1.1586 +template <>
  1.1587 +inline bool
  1.1588 +WebIDLCast<float>(JSContext *cx, HandleValue value, float *out)
  1.1589 +{
  1.1590 +    double temp;
  1.1591 +    if (!ToNumber(cx, value, &temp))
  1.1592 +        return false;
  1.1593 +    *out = static_cast<float>(temp);
  1.1594 +    return true;
  1.1595 +}
  1.1596 +
  1.1597 +template <>
  1.1598 +inline bool
  1.1599 +WebIDLCast<double>(JSContext *cx, HandleValue value, double *out)
  1.1600 +{
  1.1601 +    return ToNumber(cx, value, out);
  1.1602 +}
  1.1603 +
  1.1604 +template<typename NativeType>
  1.1605 +/* static */ bool
  1.1606 +DataViewObject::write(JSContext *cx, Handle<DataViewObject*> obj,
  1.1607 +                      CallArgs &args, const char *method)
  1.1608 +{
  1.1609 +    if (args.length() < 2) {
  1.1610 +        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
  1.1611 +                             JSMSG_MORE_ARGS_NEEDED, method, "1", "");
  1.1612 +        return false;
  1.1613 +    }
  1.1614 +
  1.1615 +    uint32_t offset;
  1.1616 +    if (!ToUint32(cx, args[0], &offset))
  1.1617 +        return false;
  1.1618 +
  1.1619 +    NativeType value;
  1.1620 +    if (!WebIDLCast(cx, args[1], &value))
  1.1621 +        return false;
  1.1622 +
  1.1623 +    bool toLittleEndian = args.length() >= 3 && ToBoolean(args[2]);
  1.1624 +
  1.1625 +    uint8_t *data = DataViewObject::getDataPointer<NativeType>(cx, obj, offset);
  1.1626 +    if (!data)
  1.1627 +        return false;
  1.1628 +
  1.1629 +    DataViewIO<NativeType>::toBuffer(data, &value, needToSwapBytes(toLittleEndian));
  1.1630 +    return true;
  1.1631 +}
  1.1632 +
  1.1633 +bool
  1.1634 +DataViewObject::getInt8Impl(JSContext *cx, CallArgs args)
  1.1635 +{
  1.1636 +    JS_ASSERT(is(args.thisv()));
  1.1637 +
  1.1638 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1639 +
  1.1640 +    int8_t val;
  1.1641 +    if (!read(cx, thisView, args, &val, "getInt8"))
  1.1642 +        return false;
  1.1643 +    args.rval().setInt32(val);
  1.1644 +    return true;
  1.1645 +}
  1.1646 +
  1.1647 +bool
  1.1648 +DataViewObject::fun_getInt8(JSContext *cx, unsigned argc, Value *vp)
  1.1649 +{
  1.1650 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1651 +    return CallNonGenericMethod<is, getInt8Impl>(cx, args);
  1.1652 +}
  1.1653 +
  1.1654 +bool
  1.1655 +DataViewObject::getUint8Impl(JSContext *cx, CallArgs args)
  1.1656 +{
  1.1657 +    JS_ASSERT(is(args.thisv()));
  1.1658 +
  1.1659 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1660 +
  1.1661 +    uint8_t val;
  1.1662 +    if (!read(cx, thisView, args, &val, "getUint8"))
  1.1663 +        return false;
  1.1664 +    args.rval().setInt32(val);
  1.1665 +    return true;
  1.1666 +}
  1.1667 +
  1.1668 +bool
  1.1669 +DataViewObject::fun_getUint8(JSContext *cx, unsigned argc, Value *vp)
  1.1670 +{
  1.1671 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1672 +    return CallNonGenericMethod<is, getUint8Impl>(cx, args);
  1.1673 +}
  1.1674 +
  1.1675 +bool
  1.1676 +DataViewObject::getInt16Impl(JSContext *cx, CallArgs args)
  1.1677 +{
  1.1678 +    JS_ASSERT(is(args.thisv()));
  1.1679 +
  1.1680 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1681 +
  1.1682 +    int16_t val;
  1.1683 +    if (!read(cx, thisView, args, &val, "getInt16"))
  1.1684 +        return false;
  1.1685 +    args.rval().setInt32(val);
  1.1686 +    return true;
  1.1687 +}
  1.1688 +
  1.1689 +bool
  1.1690 +DataViewObject::fun_getInt16(JSContext *cx, unsigned argc, Value *vp)
  1.1691 +{
  1.1692 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1693 +    return CallNonGenericMethod<is, getInt16Impl>(cx, args);
  1.1694 +}
  1.1695 +
  1.1696 +bool
  1.1697 +DataViewObject::getUint16Impl(JSContext *cx, CallArgs args)
  1.1698 +{
  1.1699 +    JS_ASSERT(is(args.thisv()));
  1.1700 +
  1.1701 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1702 +
  1.1703 +    uint16_t val;
  1.1704 +    if (!read(cx, thisView, args, &val, "getUint16"))
  1.1705 +        return false;
  1.1706 +    args.rval().setInt32(val);
  1.1707 +    return true;
  1.1708 +}
  1.1709 +
  1.1710 +bool
  1.1711 +DataViewObject::fun_getUint16(JSContext *cx, unsigned argc, Value *vp)
  1.1712 +{
  1.1713 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1714 +    return CallNonGenericMethod<is, getUint16Impl>(cx, args);
  1.1715 +}
  1.1716 +
  1.1717 +bool
  1.1718 +DataViewObject::getInt32Impl(JSContext *cx, CallArgs args)
  1.1719 +{
  1.1720 +    JS_ASSERT(is(args.thisv()));
  1.1721 +
  1.1722 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1723 +
  1.1724 +    int32_t val;
  1.1725 +    if (!read(cx, thisView, args, &val, "getInt32"))
  1.1726 +        return false;
  1.1727 +    args.rval().setInt32(val);
  1.1728 +    return true;
  1.1729 +}
  1.1730 +
  1.1731 +bool
  1.1732 +DataViewObject::fun_getInt32(JSContext *cx, unsigned argc, Value *vp)
  1.1733 +{
  1.1734 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1735 +    return CallNonGenericMethod<is, getInt32Impl>(cx, args);
  1.1736 +}
  1.1737 +
  1.1738 +bool
  1.1739 +DataViewObject::getUint32Impl(JSContext *cx, CallArgs args)
  1.1740 +{
  1.1741 +    JS_ASSERT(is(args.thisv()));
  1.1742 +
  1.1743 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1744 +
  1.1745 +    uint32_t val;
  1.1746 +    if (!read(cx, thisView, args, &val, "getUint32"))
  1.1747 +        return false;
  1.1748 +    args.rval().setNumber(val);
  1.1749 +    return true;
  1.1750 +}
  1.1751 +
  1.1752 +bool
  1.1753 +DataViewObject::fun_getUint32(JSContext *cx, unsigned argc, Value *vp)
  1.1754 +{
  1.1755 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1756 +    return CallNonGenericMethod<is, getUint32Impl>(cx, args);
  1.1757 +}
  1.1758 +
  1.1759 +bool
  1.1760 +DataViewObject::getFloat32Impl(JSContext *cx, CallArgs args)
  1.1761 +{
  1.1762 +    JS_ASSERT(is(args.thisv()));
  1.1763 +
  1.1764 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1765 +
  1.1766 +    float val;
  1.1767 +    if (!read(cx, thisView, args, &val, "getFloat32"))
  1.1768 +        return false;
  1.1769 +
  1.1770 +    args.rval().setDouble(CanonicalizeNaN(val));
  1.1771 +    return true;
  1.1772 +}
  1.1773 +
  1.1774 +bool
  1.1775 +DataViewObject::fun_getFloat32(JSContext *cx, unsigned argc, Value *vp)
  1.1776 +{
  1.1777 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1778 +    return CallNonGenericMethod<is, getFloat32Impl>(cx, args);
  1.1779 +}
  1.1780 +
  1.1781 +bool
  1.1782 +DataViewObject::getFloat64Impl(JSContext *cx, CallArgs args)
  1.1783 +{
  1.1784 +    JS_ASSERT(is(args.thisv()));
  1.1785 +
  1.1786 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1787 +
  1.1788 +    double val;
  1.1789 +    if (!read(cx, thisView, args, &val, "getFloat64"))
  1.1790 +        return false;
  1.1791 +
  1.1792 +    args.rval().setDouble(CanonicalizeNaN(val));
  1.1793 +    return true;
  1.1794 +}
  1.1795 +
  1.1796 +bool
  1.1797 +DataViewObject::fun_getFloat64(JSContext *cx, unsigned argc, Value *vp)
  1.1798 +{
  1.1799 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1800 +    return CallNonGenericMethod<is, getFloat64Impl>(cx, args);
  1.1801 +}
  1.1802 +
  1.1803 +bool
  1.1804 +DataViewObject::setInt8Impl(JSContext *cx, CallArgs args)
  1.1805 +{
  1.1806 +    JS_ASSERT(is(args.thisv()));
  1.1807 +
  1.1808 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1809 +
  1.1810 +    if (!write<int8_t>(cx, thisView, args, "setInt8"))
  1.1811 +        return false;
  1.1812 +    args.rval().setUndefined();
  1.1813 +    return true;
  1.1814 +}
  1.1815 +
  1.1816 +bool
  1.1817 +DataViewObject::fun_setInt8(JSContext *cx, unsigned argc, Value *vp)
  1.1818 +{
  1.1819 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1820 +    return CallNonGenericMethod<is, setInt8Impl>(cx, args);
  1.1821 +}
  1.1822 +
  1.1823 +bool
  1.1824 +DataViewObject::setUint8Impl(JSContext *cx, CallArgs args)
  1.1825 +{
  1.1826 +    JS_ASSERT(is(args.thisv()));
  1.1827 +
  1.1828 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1829 +
  1.1830 +    if (!write<uint8_t>(cx, thisView, args, "setUint8"))
  1.1831 +        return false;
  1.1832 +    args.rval().setUndefined();
  1.1833 +    return true;
  1.1834 +}
  1.1835 +
  1.1836 +bool
  1.1837 +DataViewObject::fun_setUint8(JSContext *cx, unsigned argc, Value *vp)
  1.1838 +{
  1.1839 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1840 +    return CallNonGenericMethod<is, setUint8Impl>(cx, args);
  1.1841 +}
  1.1842 +
  1.1843 +bool
  1.1844 +DataViewObject::setInt16Impl(JSContext *cx, CallArgs args)
  1.1845 +{
  1.1846 +    JS_ASSERT(is(args.thisv()));
  1.1847 +
  1.1848 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1849 +
  1.1850 +    if (!write<int16_t>(cx, thisView, args, "setInt16"))
  1.1851 +        return false;
  1.1852 +    args.rval().setUndefined();
  1.1853 +    return true;
  1.1854 +}
  1.1855 +
  1.1856 +bool
  1.1857 +DataViewObject::fun_setInt16(JSContext *cx, unsigned argc, Value *vp)
  1.1858 +{
  1.1859 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1860 +    return CallNonGenericMethod<is, setInt16Impl>(cx, args);
  1.1861 +}
  1.1862 +
  1.1863 +bool
  1.1864 +DataViewObject::setUint16Impl(JSContext *cx, CallArgs args)
  1.1865 +{
  1.1866 +    JS_ASSERT(is(args.thisv()));
  1.1867 +
  1.1868 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1869 +
  1.1870 +    if (!write<uint16_t>(cx, thisView, args, "setUint16"))
  1.1871 +        return false;
  1.1872 +    args.rval().setUndefined();
  1.1873 +    return true;
  1.1874 +}
  1.1875 +
  1.1876 +bool
  1.1877 +DataViewObject::fun_setUint16(JSContext *cx, unsigned argc, Value *vp)
  1.1878 +{
  1.1879 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1880 +    return CallNonGenericMethod<is, setUint16Impl>(cx, args);
  1.1881 +}
  1.1882 +
  1.1883 +bool
  1.1884 +DataViewObject::setInt32Impl(JSContext *cx, CallArgs args)
  1.1885 +{
  1.1886 +    JS_ASSERT(is(args.thisv()));
  1.1887 +
  1.1888 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1889 +
  1.1890 +    if (!write<int32_t>(cx, thisView, args, "setInt32"))
  1.1891 +        return false;
  1.1892 +    args.rval().setUndefined();
  1.1893 +    return true;
  1.1894 +}
  1.1895 +
  1.1896 +bool
  1.1897 +DataViewObject::fun_setInt32(JSContext *cx, unsigned argc, Value *vp)
  1.1898 +{
  1.1899 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1900 +    return CallNonGenericMethod<is, setInt32Impl>(cx, args);
  1.1901 +}
  1.1902 +
  1.1903 +bool
  1.1904 +DataViewObject::setUint32Impl(JSContext *cx, CallArgs args)
  1.1905 +{
  1.1906 +    JS_ASSERT(is(args.thisv()));
  1.1907 +
  1.1908 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1909 +
  1.1910 +    if (!write<uint32_t>(cx, thisView, args, "setUint32"))
  1.1911 +        return false;
  1.1912 +    args.rval().setUndefined();
  1.1913 +    return true;
  1.1914 +}
  1.1915 +
  1.1916 +bool
  1.1917 +DataViewObject::fun_setUint32(JSContext *cx, unsigned argc, Value *vp)
  1.1918 +{
  1.1919 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1920 +    return CallNonGenericMethod<is, setUint32Impl>(cx, args);
  1.1921 +}
  1.1922 +
  1.1923 +bool
  1.1924 +DataViewObject::setFloat32Impl(JSContext *cx, CallArgs args)
  1.1925 +{
  1.1926 +    JS_ASSERT(is(args.thisv()));
  1.1927 +
  1.1928 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1929 +
  1.1930 +    if (!write<float>(cx, thisView, args, "setFloat32"))
  1.1931 +        return false;
  1.1932 +    args.rval().setUndefined();
  1.1933 +    return true;
  1.1934 +}
  1.1935 +
  1.1936 +bool
  1.1937 +DataViewObject::fun_setFloat32(JSContext *cx, unsigned argc, Value *vp)
  1.1938 +{
  1.1939 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1940 +    return CallNonGenericMethod<is, setFloat32Impl>(cx, args);
  1.1941 +}
  1.1942 +
  1.1943 +bool
  1.1944 +DataViewObject::setFloat64Impl(JSContext *cx, CallArgs args)
  1.1945 +{
  1.1946 +    JS_ASSERT(is(args.thisv()));
  1.1947 +
  1.1948 +    Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
  1.1949 +
  1.1950 +    if (!write<double>(cx, thisView, args, "setFloat64"))
  1.1951 +        return false;
  1.1952 +    args.rval().setUndefined();
  1.1953 +    return true;
  1.1954 +}
  1.1955 +
  1.1956 +bool
  1.1957 +DataViewObject::fun_setFloat64(JSContext *cx, unsigned argc, Value *vp)
  1.1958 +{
  1.1959 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.1960 +    return CallNonGenericMethod<is, setFloat64Impl>(cx, args);
  1.1961 +}
  1.1962 +
  1.1963 +Value
  1.1964 +TypedArrayObject::getElement(uint32_t index)
  1.1965 +{
  1.1966 +    switch (type()) {
  1.1967 +      case ScalarTypeDescr::TYPE_INT8:
  1.1968 +        return TypedArrayObjectTemplate<int8_t>::getIndexValue(this, index);
  1.1969 +        break;
  1.1970 +      case ScalarTypeDescr::TYPE_UINT8:
  1.1971 +        return TypedArrayObjectTemplate<uint8_t>::getIndexValue(this, index);
  1.1972 +        break;
  1.1973 +      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
  1.1974 +        return TypedArrayObjectTemplate<uint8_clamped>::getIndexValue(this, index);
  1.1975 +        break;
  1.1976 +      case ScalarTypeDescr::TYPE_INT16:
  1.1977 +        return TypedArrayObjectTemplate<int16_t>::getIndexValue(this, index);
  1.1978 +        break;
  1.1979 +      case ScalarTypeDescr::TYPE_UINT16:
  1.1980 +        return TypedArrayObjectTemplate<uint16_t>::getIndexValue(this, index);
  1.1981 +        break;
  1.1982 +      case ScalarTypeDescr::TYPE_INT32:
  1.1983 +        return TypedArrayObjectTemplate<int32_t>::getIndexValue(this, index);
  1.1984 +        break;
  1.1985 +      case ScalarTypeDescr::TYPE_UINT32:
  1.1986 +        return TypedArrayObjectTemplate<uint32_t>::getIndexValue(this, index);
  1.1987 +        break;
  1.1988 +      case ScalarTypeDescr::TYPE_FLOAT32:
  1.1989 +        return TypedArrayObjectTemplate<float>::getIndexValue(this, index);
  1.1990 +        break;
  1.1991 +      case ScalarTypeDescr::TYPE_FLOAT64:
  1.1992 +        return TypedArrayObjectTemplate<double>::getIndexValue(this, index);
  1.1993 +        break;
  1.1994 +      default:
  1.1995 +        MOZ_ASSUME_UNREACHABLE("Unknown TypedArray type");
  1.1996 +        break;
  1.1997 +    }
  1.1998 +}
  1.1999 +
  1.2000 +void
  1.2001 +TypedArrayObject::setElement(TypedArrayObject &obj, uint32_t index, double d)
  1.2002 +{
  1.2003 +    MOZ_ASSERT(index < obj.length());
  1.2004 +
  1.2005 +    switch (obj.type()) {
  1.2006 +      case ScalarTypeDescr::TYPE_INT8:
  1.2007 +        TypedArrayObjectTemplate<int8_t>::setIndexValue(obj, index, d);
  1.2008 +        break;
  1.2009 +      case ScalarTypeDescr::TYPE_UINT8:
  1.2010 +        TypedArrayObjectTemplate<uint8_t>::setIndexValue(obj, index, d);
  1.2011 +        break;
  1.2012 +      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
  1.2013 +        TypedArrayObjectTemplate<uint8_clamped>::setIndexValue(obj, index, d);
  1.2014 +        break;
  1.2015 +      case ScalarTypeDescr::TYPE_INT16:
  1.2016 +        TypedArrayObjectTemplate<int16_t>::setIndexValue(obj, index, d);
  1.2017 +        break;
  1.2018 +      case ScalarTypeDescr::TYPE_UINT16:
  1.2019 +        TypedArrayObjectTemplate<uint16_t>::setIndexValue(obj, index, d);
  1.2020 +        break;
  1.2021 +      case ScalarTypeDescr::TYPE_INT32:
  1.2022 +        TypedArrayObjectTemplate<int32_t>::setIndexValue(obj, index, d);
  1.2023 +        break;
  1.2024 +      case ScalarTypeDescr::TYPE_UINT32:
  1.2025 +        TypedArrayObjectTemplate<uint32_t>::setIndexValue(obj, index, d);
  1.2026 +        break;
  1.2027 +      case ScalarTypeDescr::TYPE_FLOAT32:
  1.2028 +        TypedArrayObjectTemplate<float>::setIndexValue(obj, index, d);
  1.2029 +        break;
  1.2030 +      case ScalarTypeDescr::TYPE_FLOAT64:
  1.2031 +        TypedArrayObjectTemplate<double>::setIndexValue(obj, index, d);
  1.2032 +        break;
  1.2033 +      default:
  1.2034 +        MOZ_ASSUME_UNREACHABLE("Unknown TypedArray type");
  1.2035 +        break;
  1.2036 +    }
  1.2037 +}
  1.2038 +
  1.2039 +/***
  1.2040 + *** JS impl
  1.2041 + ***/
  1.2042 +
  1.2043 +/*
  1.2044 + * TypedArrayObject boilerplate
  1.2045 + */
  1.2046 +
  1.2047 +#ifndef RELEASE_BUILD
  1.2048 +# define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                     \
  1.2049 +const JSFunctionSpec _typedArray##Object::jsfuncs[] = {                            \
  1.2050 +    JS_SELF_HOSTED_FN("@@iterator", "ArrayValues", 0, 0),                          \
  1.2051 +    JS_FN("subarray", _typedArray##Object::fun_subarray, 2, JSFUN_GENERIC_NATIVE), \
  1.2052 +    JS_FN("set", _typedArray##Object::fun_set, 2, JSFUN_GENERIC_NATIVE),           \
  1.2053 +    JS_FN("move", _typedArray##Object::fun_move, 3, JSFUN_GENERIC_NATIVE),         \
  1.2054 +    JS_FS_END                                                                      \
  1.2055 +}
  1.2056 +#else
  1.2057 +# define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                     \
  1.2058 +const JSFunctionSpec _typedArray##Object::jsfuncs[] = {                            \
  1.2059 +    JS_SELF_HOSTED_FN("@@iterator", "ArrayValues", 0, 0),                          \
  1.2060 +    JS_FN("subarray", _typedArray##Object::fun_subarray, 2, JSFUN_GENERIC_NATIVE), \
  1.2061 +    JS_FN("set", _typedArray##Object::fun_set, 2, JSFUN_GENERIC_NATIVE),           \
  1.2062 +    JS_FS_END                                                                      \
  1.2063 +}
  1.2064 +#endif
  1.2065 +
  1.2066 +#define IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Name,NativeType)                                    \
  1.2067 +  JS_FRIEND_API(JSObject *) JS_New ## Name ## Array(JSContext *cx, uint32_t nelements)          \
  1.2068 +  {                                                                                             \
  1.2069 +      return TypedArrayObjectTemplate<NativeType>::fromLength(cx, nelements);                   \
  1.2070 +  }                                                                                             \
  1.2071 +  JS_FRIEND_API(JSObject *) JS_New ## Name ## ArrayFromArray(JSContext *cx, HandleObject other) \
  1.2072 +  {                                                                                             \
  1.2073 +      return TypedArrayObjectTemplate<NativeType>::fromArray(cx, other);                        \
  1.2074 +  }                                                                                             \
  1.2075 +  JS_FRIEND_API(JSObject *) JS_New ## Name ## ArrayWithBuffer(JSContext *cx,                    \
  1.2076 +                               HandleObject arrayBuffer, uint32_t byteOffset, int32_t length)   \
  1.2077 +  {                                                                                             \
  1.2078 +      return TypedArrayObjectTemplate<NativeType>::fromBuffer(cx, arrayBuffer, byteOffset,      \
  1.2079 +                                                              length, js::NullPtr());           \
  1.2080 +  }                                                                                             \
  1.2081 +  JS_FRIEND_API(bool) JS_Is ## Name ## Array(JSObject *obj)                                     \
  1.2082 +  {                                                                                             \
  1.2083 +      if (!(obj = CheckedUnwrap(obj)))                                                          \
  1.2084 +          return false;                                                                         \
  1.2085 +      const Class *clasp = obj->getClass();                                                     \
  1.2086 +      return clasp == &TypedArrayObject::classes[TypedArrayObjectTemplate<NativeType>::ArrayTypeID()]; \
  1.2087 +  } \
  1.2088 +  JS_FRIEND_API(JSObject *) js::Unwrap ## Name ## Array(JSObject *obj)                          \
  1.2089 +  {                                                                                             \
  1.2090 +      obj = CheckedUnwrap(obj);                                                                 \
  1.2091 +      if (!obj)                                                                                 \
  1.2092 +          return nullptr;                                                                       \
  1.2093 +      const Class *clasp = obj->getClass();                                                     \
  1.2094 +      if (clasp == &TypedArrayObject::classes[TypedArrayObjectTemplate<NativeType>::ArrayTypeID()]) \
  1.2095 +          return obj;                                                                           \
  1.2096 +      return nullptr;                                                                           \
  1.2097 +  } \
  1.2098 +  const js::Class* const js::detail::Name ## ArrayClassPtr =                                    \
  1.2099 +      &js::TypedArrayObject::classes[TypedArrayObjectTemplate<NativeType>::ArrayTypeID()];
  1.2100 +
  1.2101 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Int8, int8_t)
  1.2102 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Uint8, uint8_t)
  1.2103 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Uint8Clamped, uint8_clamped)
  1.2104 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Int16, int16_t)
  1.2105 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Uint16, uint16_t)
  1.2106 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Int32, int32_t)
  1.2107 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Uint32, uint32_t)
  1.2108 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Float32, float)
  1.2109 +IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Float64, double)
  1.2110 +
  1.2111 +#define IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Name, ExternalType, InternalType)              \
  1.2112 +  JS_FRIEND_API(JSObject *) JS_GetObjectAs ## Name ## Array(JSObject *obj,                  \
  1.2113 +                                                            uint32_t *length,               \
  1.2114 +                                                            ExternalType **data)            \
  1.2115 +  {                                                                                         \
  1.2116 +      if (!(obj = CheckedUnwrap(obj)))                                                      \
  1.2117 +          return nullptr;                                                                   \
  1.2118 +                                                                                            \
  1.2119 +      const Class *clasp = obj->getClass();                                                 \
  1.2120 +      if (clasp != &TypedArrayObject::classes[TypedArrayObjectTemplate<InternalType>::ArrayTypeID()]) \
  1.2121 +          return nullptr;                                                                   \
  1.2122 +                                                                                            \
  1.2123 +      TypedArrayObject *tarr = &obj->as<TypedArrayObject>();                                \
  1.2124 +      *length = tarr->length();                                                             \
  1.2125 +      *data = static_cast<ExternalType *>(tarr->viewData());                                \
  1.2126 +                                                                                            \
  1.2127 +      return obj;                                                                           \
  1.2128 +  }
  1.2129 +
  1.2130 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Int8, int8_t, int8_t)
  1.2131 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Uint8, uint8_t, uint8_t)
  1.2132 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Uint8Clamped, uint8_t, uint8_clamped)
  1.2133 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Int16, int16_t, int16_t)
  1.2134 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Uint16, uint16_t, uint16_t)
  1.2135 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Int32, int32_t, int32_t)
  1.2136 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Uint32, uint32_t, uint32_t)
  1.2137 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Float32, float, float)
  1.2138 +IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Float64, double, double)
  1.2139 +
  1.2140 +#define IMPL_TYPED_ARRAY_PROTO_CLASS(_typedArray)                              \
  1.2141 +{                                                                              \
  1.2142 +    #_typedArray "Prototype",                                                  \
  1.2143 +    JSCLASS_HAS_RESERVED_SLOTS(TypedArrayObject::RESERVED_SLOTS) |             \
  1.2144 +    JSCLASS_HAS_PRIVATE |                                                      \
  1.2145 +    JSCLASS_HAS_CACHED_PROTO(JSProto_##_typedArray),                           \
  1.2146 +    JS_PropertyStub,         /* addProperty */                                 \
  1.2147 +    JS_DeletePropertyStub,   /* delProperty */                                 \
  1.2148 +    JS_PropertyStub,         /* getProperty */                                 \
  1.2149 +    JS_StrictPropertyStub,   /* setProperty */                                 \
  1.2150 +    JS_EnumerateStub,                                                          \
  1.2151 +    JS_ResolveStub,                                                            \
  1.2152 +    JS_ConvertStub                                                             \
  1.2153 +}
  1.2154 +
  1.2155 +#define IMPL_TYPED_ARRAY_FAST_CLASS(_typedArray)                               \
  1.2156 +{                                                                              \
  1.2157 +    #_typedArray,                                                              \
  1.2158 +    JSCLASS_HAS_RESERVED_SLOTS(TypedArrayObject::RESERVED_SLOTS) |             \
  1.2159 +    JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS |                        \
  1.2160 +    JSCLASS_HAS_CACHED_PROTO(JSProto_##_typedArray),                           \
  1.2161 +    JS_PropertyStub,         /* addProperty */                                 \
  1.2162 +    JS_DeletePropertyStub,   /* delProperty */                                 \
  1.2163 +    JS_PropertyStub,         /* getProperty */                                 \
  1.2164 +    JS_StrictPropertyStub,   /* setProperty */                                 \
  1.2165 +    JS_EnumerateStub,                                                          \
  1.2166 +    JS_ResolveStub,                                                            \
  1.2167 +    JS_ConvertStub,                                                            \
  1.2168 +    nullptr,                 /* finalize */                                    \
  1.2169 +    nullptr,                 /* call        */                                 \
  1.2170 +    nullptr,                 /* hasInstance */                                 \
  1.2171 +    nullptr,                 /* construct   */                                 \
  1.2172 +    ArrayBufferViewObject::trace, /* trace  */                                 \
  1.2173 +}
  1.2174 +
  1.2175 +template<class ArrayType>
  1.2176 +static inline bool
  1.2177 +InitTypedArrayClass(JSContext *cx)
  1.2178 +{
  1.2179 +    Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
  1.2180 +    if (global->isStandardClassResolved(ArrayType::key))
  1.2181 +        return true;
  1.2182 +
  1.2183 +    RootedObject proto(cx, global->createBlankPrototype(cx, ArrayType::protoClass()));
  1.2184 +    if (!proto)
  1.2185 +        return false;
  1.2186 +
  1.2187 +    RootedFunction ctor(cx);
  1.2188 +    ctor = global->createConstructor(cx, ArrayType::class_constructor,
  1.2189 +                                     ClassName(ArrayType::key, cx), 3);
  1.2190 +    if (!ctor)
  1.2191 +        return false;
  1.2192 +
  1.2193 +    if (!LinkConstructorAndPrototype(cx, ctor, proto))
  1.2194 +        return false;
  1.2195 +
  1.2196 +    RootedValue bytesValue(cx, Int32Value(ArrayType::BYTES_PER_ELEMENT));
  1.2197 +
  1.2198 +    if (!JSObject::defineProperty(cx, ctor,
  1.2199 +                                  cx->names().BYTES_PER_ELEMENT, bytesValue,
  1.2200 +                                  JS_PropertyStub, JS_StrictPropertyStub,
  1.2201 +                                  JSPROP_PERMANENT | JSPROP_READONLY) ||
  1.2202 +        !JSObject::defineProperty(cx, proto,
  1.2203 +                                  cx->names().BYTES_PER_ELEMENT, bytesValue,
  1.2204 +                                  JS_PropertyStub, JS_StrictPropertyStub,
  1.2205 +                                  JSPROP_PERMANENT | JSPROP_READONLY))
  1.2206 +    {
  1.2207 +        return false;
  1.2208 +    }
  1.2209 +
  1.2210 +    if (!ArrayType::defineGetters(cx, proto))
  1.2211 +        return false;
  1.2212 +
  1.2213 +    if (!JS_DefineFunctions(cx, proto, ArrayType::jsfuncs))
  1.2214 +        return false;
  1.2215 +
  1.2216 +    RootedFunction fun(cx);
  1.2217 +    fun =
  1.2218 +        NewFunction(cx, NullPtr(),
  1.2219 +                    ArrayBufferObject::createTypedArrayFromBuffer<typename ArrayType::ThisType>,
  1.2220 +                    0, JSFunction::NATIVE_FUN, global, NullPtr());
  1.2221 +    if (!fun)
  1.2222 +        return false;
  1.2223 +
  1.2224 +    if (!GlobalObject::initBuiltinConstructor(cx, global, ArrayType::key, ctor, proto))
  1.2225 +        return false;
  1.2226 +
  1.2227 +    global->setCreateArrayFromBuffer<typename ArrayType::ThisType>(fun);
  1.2228 +
  1.2229 +    return true;
  1.2230 +}
  1.2231 +
  1.2232 +IMPL_TYPED_ARRAY_STATICS(Int8Array);
  1.2233 +IMPL_TYPED_ARRAY_STATICS(Uint8Array);
  1.2234 +IMPL_TYPED_ARRAY_STATICS(Int16Array);
  1.2235 +IMPL_TYPED_ARRAY_STATICS(Uint16Array);
  1.2236 +IMPL_TYPED_ARRAY_STATICS(Int32Array);
  1.2237 +IMPL_TYPED_ARRAY_STATICS(Uint32Array);
  1.2238 +IMPL_TYPED_ARRAY_STATICS(Float32Array);
  1.2239 +IMPL_TYPED_ARRAY_STATICS(Float64Array);
  1.2240 +IMPL_TYPED_ARRAY_STATICS(Uint8ClampedArray);
  1.2241 +
  1.2242 +const Class TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX] = {
  1.2243 +    IMPL_TYPED_ARRAY_FAST_CLASS(Int8Array),
  1.2244 +    IMPL_TYPED_ARRAY_FAST_CLASS(Uint8Array),
  1.2245 +    IMPL_TYPED_ARRAY_FAST_CLASS(Int16Array),
  1.2246 +    IMPL_TYPED_ARRAY_FAST_CLASS(Uint16Array),
  1.2247 +    IMPL_TYPED_ARRAY_FAST_CLASS(Int32Array),
  1.2248 +    IMPL_TYPED_ARRAY_FAST_CLASS(Uint32Array),
  1.2249 +    IMPL_TYPED_ARRAY_FAST_CLASS(Float32Array),
  1.2250 +    IMPL_TYPED_ARRAY_FAST_CLASS(Float64Array),
  1.2251 +    IMPL_TYPED_ARRAY_FAST_CLASS(Uint8ClampedArray)
  1.2252 +};
  1.2253 +
  1.2254 +const Class TypedArrayObject::protoClasses[ScalarTypeDescr::TYPE_MAX] = {
  1.2255 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Int8Array),
  1.2256 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Uint8Array),
  1.2257 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Int16Array),
  1.2258 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Uint16Array),
  1.2259 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Int32Array),
  1.2260 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Uint32Array),
  1.2261 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Float32Array),
  1.2262 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Float64Array),
  1.2263 +    IMPL_TYPED_ARRAY_PROTO_CLASS(Uint8ClampedArray)
  1.2264 +};
  1.2265 +
  1.2266 +#define CHECK(t, a) { if (t == a::IsThisClass) return true; }
  1.2267 +JS_FRIEND_API(bool)
  1.2268 +js::IsTypedArrayThisCheck(JS::IsAcceptableThis test)
  1.2269 +{
  1.2270 +    CHECK(test, Int8ArrayObject);
  1.2271 +    CHECK(test, Uint8ArrayObject);
  1.2272 +    CHECK(test, Int16ArrayObject);
  1.2273 +    CHECK(test, Uint16ArrayObject);
  1.2274 +    CHECK(test, Int32ArrayObject);
  1.2275 +    CHECK(test, Uint32ArrayObject);
  1.2276 +    CHECK(test, Float32ArrayObject);
  1.2277 +    CHECK(test, Float64ArrayObject);
  1.2278 +    CHECK(test, Uint8ClampedArrayObject);
  1.2279 +    return false;
  1.2280 +}
  1.2281 +#undef CHECK
  1.2282 +
  1.2283 +static JSObject *
  1.2284 +InitArrayBufferClass(JSContext *cx)
  1.2285 +{
  1.2286 +    Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
  1.2287 +    if (global->isStandardClassResolved(JSProto_ArrayBuffer))
  1.2288 +        return &global->getPrototype(JSProto_ArrayBuffer).toObject();
  1.2289 +
  1.2290 +    RootedObject arrayBufferProto(cx, global->createBlankPrototype(cx, &ArrayBufferObject::protoClass));
  1.2291 +    if (!arrayBufferProto)
  1.2292 +        return nullptr;
  1.2293 +
  1.2294 +    RootedFunction ctor(cx, global->createConstructor(cx, ArrayBufferObject::class_constructor,
  1.2295 +                                                      cx->names().ArrayBuffer, 1));
  1.2296 +    if (!ctor)
  1.2297 +        return nullptr;
  1.2298 +
  1.2299 +    if (!LinkConstructorAndPrototype(cx, ctor, arrayBufferProto))
  1.2300 +        return nullptr;
  1.2301 +
  1.2302 +    RootedId byteLengthId(cx, NameToId(cx->names().byteLength));
  1.2303 +    unsigned attrs = JSPROP_SHARED | JSPROP_GETTER | JSPROP_PERMANENT;
  1.2304 +    JSObject *getter = NewFunction(cx, NullPtr(), ArrayBufferObject::byteLengthGetter, 0,
  1.2305 +                                   JSFunction::NATIVE_FUN, global, NullPtr());
  1.2306 +    if (!getter)
  1.2307 +        return nullptr;
  1.2308 +
  1.2309 +    if (!DefineNativeProperty(cx, arrayBufferProto, byteLengthId, UndefinedHandleValue,
  1.2310 +                              JS_DATA_TO_FUNC_PTR(PropertyOp, getter), nullptr, attrs))
  1.2311 +        return nullptr;
  1.2312 +
  1.2313 +    if (!JS_DefineFunctions(cx, ctor, ArrayBufferObject::jsstaticfuncs))
  1.2314 +        return nullptr;
  1.2315 +
  1.2316 +    if (!JS_DefineFunctions(cx, arrayBufferProto, ArrayBufferObject::jsfuncs))
  1.2317 +        return nullptr;
  1.2318 +
  1.2319 +    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_ArrayBuffer,
  1.2320 +                                              ctor, arrayBufferProto))
  1.2321 +    {
  1.2322 +        return nullptr;
  1.2323 +    }
  1.2324 +
  1.2325 +    return arrayBufferProto;
  1.2326 +}
  1.2327 +
  1.2328 +const Class DataViewObject::protoClass = {
  1.2329 +    "DataViewPrototype",
  1.2330 +    JSCLASS_HAS_PRIVATE |
  1.2331 +    JSCLASS_HAS_RESERVED_SLOTS(DataViewObject::RESERVED_SLOTS) |
  1.2332 +    JSCLASS_HAS_CACHED_PROTO(JSProto_DataView),
  1.2333 +    JS_PropertyStub,         /* addProperty */
  1.2334 +    JS_DeletePropertyStub,   /* delProperty */
  1.2335 +    JS_PropertyStub,         /* getProperty */
  1.2336 +    JS_StrictPropertyStub,   /* setProperty */
  1.2337 +    JS_EnumerateStub,
  1.2338 +    JS_ResolveStub,
  1.2339 +    JS_ConvertStub
  1.2340 +};
  1.2341 +
  1.2342 +const Class DataViewObject::class_ = {
  1.2343 +    "DataView",
  1.2344 +    JSCLASS_HAS_PRIVATE |
  1.2345 +    JSCLASS_IMPLEMENTS_BARRIERS |
  1.2346 +    JSCLASS_HAS_RESERVED_SLOTS(DataViewObject::RESERVED_SLOTS) |
  1.2347 +    JSCLASS_HAS_CACHED_PROTO(JSProto_DataView),
  1.2348 +    JS_PropertyStub,         /* addProperty */
  1.2349 +    JS_DeletePropertyStub,   /* delProperty */
  1.2350 +    JS_PropertyStub,         /* getProperty */
  1.2351 +    JS_StrictPropertyStub,   /* setProperty */
  1.2352 +    JS_EnumerateStub,
  1.2353 +    JS_ResolveStub,
  1.2354 +    JS_ConvertStub,
  1.2355 +    nullptr,                 /* finalize */
  1.2356 +    nullptr,                 /* call        */
  1.2357 +    nullptr,                 /* hasInstance */
  1.2358 +    nullptr,                 /* construct   */
  1.2359 +    ArrayBufferViewObject::trace, /* trace  */
  1.2360 +};
  1.2361 +
  1.2362 +const JSFunctionSpec DataViewObject::jsfuncs[] = {
  1.2363 +    JS_FN("getInt8",    DataViewObject::fun_getInt8,      1,0),
  1.2364 +    JS_FN("getUint8",   DataViewObject::fun_getUint8,     1,0),
  1.2365 +    JS_FN("getInt16",   DataViewObject::fun_getInt16,     2,0),
  1.2366 +    JS_FN("getUint16",  DataViewObject::fun_getUint16,    2,0),
  1.2367 +    JS_FN("getInt32",   DataViewObject::fun_getInt32,     2,0),
  1.2368 +    JS_FN("getUint32",  DataViewObject::fun_getUint32,    2,0),
  1.2369 +    JS_FN("getFloat32", DataViewObject::fun_getFloat32,   2,0),
  1.2370 +    JS_FN("getFloat64", DataViewObject::fun_getFloat64,   2,0),
  1.2371 +    JS_FN("setInt8",    DataViewObject::fun_setInt8,      2,0),
  1.2372 +    JS_FN("setUint8",   DataViewObject::fun_setUint8,     2,0),
  1.2373 +    JS_FN("setInt16",   DataViewObject::fun_setInt16,     3,0),
  1.2374 +    JS_FN("setUint16",  DataViewObject::fun_setUint16,    3,0),
  1.2375 +    JS_FN("setInt32",   DataViewObject::fun_setInt32,     3,0),
  1.2376 +    JS_FN("setUint32",  DataViewObject::fun_setUint32,    3,0),
  1.2377 +    JS_FN("setFloat32", DataViewObject::fun_setFloat32,   3,0),
  1.2378 +    JS_FN("setFloat64", DataViewObject::fun_setFloat64,   3,0),
  1.2379 +    JS_FS_END
  1.2380 +};
  1.2381 +
  1.2382 +template<Value ValueGetter(DataViewObject *view)>
  1.2383 +bool
  1.2384 +DataViewObject::getterImpl(JSContext *cx, CallArgs args)
  1.2385 +{
  1.2386 +    args.rval().set(ValueGetter(&args.thisv().toObject().as<DataViewObject>()));
  1.2387 +    return true;
  1.2388 +}
  1.2389 +
  1.2390 +template<Value ValueGetter(DataViewObject *view)>
  1.2391 +bool
  1.2392 +DataViewObject::getter(JSContext *cx, unsigned argc, Value *vp)
  1.2393 +{
  1.2394 +    CallArgs args = CallArgsFromVp(argc, vp);
  1.2395 +    return CallNonGenericMethod<is, getterImpl<ValueGetter> >(cx, args);
  1.2396 +}
  1.2397 +
  1.2398 +template<Value ValueGetter(DataViewObject *view)>
  1.2399 +bool
  1.2400 +DataViewObject::defineGetter(JSContext *cx, PropertyName *name, HandleObject proto)
  1.2401 +{
  1.2402 +    RootedId id(cx, NameToId(name));
  1.2403 +    unsigned attrs = JSPROP_SHARED | JSPROP_GETTER | JSPROP_PERMANENT;
  1.2404 +
  1.2405 +    Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
  1.2406 +    JSObject *getter = NewFunction(cx, NullPtr(), DataViewObject::getter<ValueGetter>, 0,
  1.2407 +                                   JSFunction::NATIVE_FUN, global, NullPtr());
  1.2408 +    if (!getter)
  1.2409 +        return false;
  1.2410 +
  1.2411 +    return DefineNativeProperty(cx, proto, id, UndefinedHandleValue,
  1.2412 +                                JS_DATA_TO_FUNC_PTR(PropertyOp, getter), nullptr, attrs);
  1.2413 +}
  1.2414 +
  1.2415 +/* static */ bool
  1.2416 +DataViewObject::initClass(JSContext *cx)
  1.2417 +{
  1.2418 +    Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
  1.2419 +    if (global->isStandardClassResolved(JSProto_DataView))
  1.2420 +        return true;
  1.2421 +
  1.2422 +    RootedObject proto(cx, global->createBlankPrototype(cx, &DataViewObject::protoClass));
  1.2423 +    if (!proto)
  1.2424 +        return false;
  1.2425 +
  1.2426 +    RootedFunction ctor(cx, global->createConstructor(cx, DataViewObject::class_constructor,
  1.2427 +                                                      cx->names().DataView, 3));
  1.2428 +    if (!ctor)
  1.2429 +        return false;
  1.2430 +
  1.2431 +    if (!LinkConstructorAndPrototype(cx, ctor, proto))
  1.2432 +        return false;
  1.2433 +
  1.2434 +    if (!defineGetter<bufferValue>(cx, cx->names().buffer, proto))
  1.2435 +        return false;
  1.2436 +
  1.2437 +    if (!defineGetter<byteLengthValue>(cx, cx->names().byteLength, proto))
  1.2438 +        return false;
  1.2439 +
  1.2440 +    if (!defineGetter<byteOffsetValue>(cx, cx->names().byteOffset, proto))
  1.2441 +        return false;
  1.2442 +
  1.2443 +    if (!JS_DefineFunctions(cx, proto, DataViewObject::jsfuncs))
  1.2444 +        return false;
  1.2445 +
  1.2446 +    /*
  1.2447 +     * Create a helper function to implement the craziness of
  1.2448 +     * |new DataView(new otherWindow.ArrayBuffer())|, and install it in the
  1.2449 +     * global for use by the DataViewObject constructor.
  1.2450 +     */
  1.2451 +    RootedFunction fun(cx, NewFunction(cx, NullPtr(), ArrayBufferObject::createDataViewForThis,
  1.2452 +                                       0, JSFunction::NATIVE_FUN, global, NullPtr()));
  1.2453 +    if (!fun)
  1.2454 +        return false;
  1.2455 +
  1.2456 +    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_DataView, ctor, proto))
  1.2457 +        return false;
  1.2458 +
  1.2459 +    global->setCreateDataViewForThis(fun);
  1.2460 +
  1.2461 +    return true;
  1.2462 +}
  1.2463 +
  1.2464 +void
  1.2465 +DataViewObject::neuter(void *newData)
  1.2466 +{
  1.2467 +    setSlot(BYTELENGTH_SLOT, Int32Value(0));
  1.2468 +    setSlot(BYTEOFFSET_SLOT, Int32Value(0));
  1.2469 +    setPrivate(newData);
  1.2470 +}
  1.2471 +
  1.2472 +JSObject *
  1.2473 +js_InitTypedArrayClasses(JSContext *cx, HandleObject obj)
  1.2474 +{
  1.2475 +    if (!InitTypedArrayClass<Int8ArrayObject>(cx) ||
  1.2476 +        !InitTypedArrayClass<Uint8ArrayObject>(cx) ||
  1.2477 +        !InitTypedArrayClass<Int16ArrayObject>(cx) ||
  1.2478 +        !InitTypedArrayClass<Uint16ArrayObject>(cx) ||
  1.2479 +        !InitTypedArrayClass<Int32ArrayObject>(cx) ||
  1.2480 +        !InitTypedArrayClass<Uint32ArrayObject>(cx) ||
  1.2481 +        !InitTypedArrayClass<Float32ArrayObject>(cx) ||
  1.2482 +        !InitTypedArrayClass<Float64ArrayObject>(cx) ||
  1.2483 +        !InitTypedArrayClass<Uint8ClampedArrayObject>(cx) ||
  1.2484 +        !DataViewObject::initClass(cx))
  1.2485 +    {
  1.2486 +        return nullptr;
  1.2487 +    }
  1.2488 +
  1.2489 +    return InitArrayBufferClass(cx);
  1.2490 +}
  1.2491 +
  1.2492 +bool
  1.2493 +js::IsTypedArrayConstructor(HandleValue v, uint32_t type)
  1.2494 +{
  1.2495 +    switch (type) {
  1.2496 +      case ScalarTypeDescr::TYPE_INT8:
  1.2497 +        return IsNativeFunction(v, Int8ArrayObject::class_constructor);
  1.2498 +      case ScalarTypeDescr::TYPE_UINT8:
  1.2499 +        return IsNativeFunction(v, Uint8ArrayObject::class_constructor);
  1.2500 +      case ScalarTypeDescr::TYPE_INT16:
  1.2501 +        return IsNativeFunction(v, Int16ArrayObject::class_constructor);
  1.2502 +      case ScalarTypeDescr::TYPE_UINT16:
  1.2503 +        return IsNativeFunction(v, Uint16ArrayObject::class_constructor);
  1.2504 +      case ScalarTypeDescr::TYPE_INT32:
  1.2505 +        return IsNativeFunction(v, Int32ArrayObject::class_constructor);
  1.2506 +      case ScalarTypeDescr::TYPE_UINT32:
  1.2507 +        return IsNativeFunction(v, Uint32ArrayObject::class_constructor);
  1.2508 +      case ScalarTypeDescr::TYPE_FLOAT32:
  1.2509 +        return IsNativeFunction(v, Float32ArrayObject::class_constructor);
  1.2510 +      case ScalarTypeDescr::TYPE_FLOAT64:
  1.2511 +        return IsNativeFunction(v, Float64ArrayObject::class_constructor);
  1.2512 +      case ScalarTypeDescr::TYPE_UINT8_CLAMPED:
  1.2513 +        return IsNativeFunction(v, Uint8ClampedArrayObject::class_constructor);
  1.2514 +    }
  1.2515 +    MOZ_ASSUME_UNREACHABLE("unexpected typed array type");
  1.2516 +}
  1.2517 +
  1.2518 +bool
  1.2519 +js::IsTypedArrayBuffer(HandleValue v)
  1.2520 +{
  1.2521 +    return v.isObject() &&
  1.2522 +           (v.toObject().is<ArrayBufferObject>() ||
  1.2523 +            v.toObject().is<SharedArrayBufferObject>());
  1.2524 +}
  1.2525 +
  1.2526 +ArrayBufferObject &
  1.2527 +js::AsTypedArrayBuffer(HandleValue v)
  1.2528 +{
  1.2529 +    JS_ASSERT(IsTypedArrayBuffer(v));
  1.2530 +    if (v.toObject().is<ArrayBufferObject>())
  1.2531 +        return v.toObject().as<ArrayBufferObject>();
  1.2532 +    return v.toObject().as<SharedArrayBufferObject>();
  1.2533 +}
  1.2534 +
  1.2535 +bool
  1.2536 +js::StringIsTypedArrayIndex(JSLinearString *str, uint64_t *indexp)
  1.2537 +{
  1.2538 +    const jschar *s = str->chars();
  1.2539 +    const jschar *end = s + str->length();
  1.2540 +
  1.2541 +    if (s == end)
  1.2542 +        return false;
  1.2543 +
  1.2544 +    bool negative = false;
  1.2545 +    if (*s == '-') {
  1.2546 +        negative = true;
  1.2547 +        if (++s == end)
  1.2548 +            return false;
  1.2549 +    }
  1.2550 +
  1.2551 +    if (!JS7_ISDEC(*s))
  1.2552 +        return false;
  1.2553 +
  1.2554 +    uint64_t index = 0;
  1.2555 +    uint32_t digit = JS7_UNDEC(*s++);
  1.2556 +
  1.2557 +    /* Don't allow leading zeros. */
  1.2558 +    if (digit == 0 && s != end)
  1.2559 +        return false;
  1.2560 +
  1.2561 +    index = digit;
  1.2562 +
  1.2563 +    for (; s < end; s++) {
  1.2564 +        if (!JS7_ISDEC(*s))
  1.2565 +            return false;
  1.2566 +
  1.2567 +        digit = JS7_UNDEC(*s);
  1.2568 +
  1.2569 +        /* Watch for overflows. */
  1.2570 +        if ((UINT64_MAX - digit) / 10 < index)
  1.2571 +            index = UINT64_MAX;
  1.2572 +        else
  1.2573 +            index = 10 * index + digit;
  1.2574 +    }
  1.2575 +
  1.2576 +    if (negative)
  1.2577 +        *indexp = UINT64_MAX;
  1.2578 +    else
  1.2579 +        *indexp = index;
  1.2580 +    return true;
  1.2581 +}
  1.2582 +
  1.2583 +/* JS Friend API */
  1.2584 +
  1.2585 +JS_FRIEND_API(bool)
  1.2586 +JS_IsTypedArrayObject(JSObject *obj)
  1.2587 +{
  1.2588 +    obj = CheckedUnwrap(obj);
  1.2589 +    return obj ? obj->is<TypedArrayObject>() : false;
  1.2590 +}
  1.2591 +
  1.2592 +JS_FRIEND_API(uint32_t)
  1.2593 +JS_GetTypedArrayLength(JSObject *obj)
  1.2594 +{
  1.2595 +    obj = CheckedUnwrap(obj);
  1.2596 +    if (!obj)
  1.2597 +        return 0;
  1.2598 +    return obj->as<TypedArrayObject>().length();
  1.2599 +}
  1.2600 +
  1.2601 +JS_FRIEND_API(uint32_t)
  1.2602 +JS_GetTypedArrayByteOffset(JSObject *obj)
  1.2603 +{
  1.2604 +    obj = CheckedUnwrap(obj);
  1.2605 +    if (!obj)
  1.2606 +        return 0;
  1.2607 +    return obj->as<TypedArrayObject>().byteOffset();
  1.2608 +}
  1.2609 +
  1.2610 +JS_FRIEND_API(uint32_t)
  1.2611 +JS_GetTypedArrayByteLength(JSObject *obj)
  1.2612 +{
  1.2613 +    obj = CheckedUnwrap(obj);
  1.2614 +    if (!obj)
  1.2615 +        return 0;
  1.2616 +    return obj->as<TypedArrayObject>().byteLength();
  1.2617 +}
  1.2618 +
  1.2619 +JS_FRIEND_API(JSArrayBufferViewType)
  1.2620 +JS_GetArrayBufferViewType(JSObject *obj)
  1.2621 +{
  1.2622 +    obj = CheckedUnwrap(obj);
  1.2623 +    if (!obj)
  1.2624 +        return ArrayBufferView::TYPE_MAX;
  1.2625 +
  1.2626 +    if (obj->is<TypedArrayObject>())
  1.2627 +        return static_cast<JSArrayBufferViewType>(obj->as<TypedArrayObject>().type());
  1.2628 +    else if (obj->is<DataViewObject>())
  1.2629 +        return ArrayBufferView::TYPE_DATAVIEW;
  1.2630 +    MOZ_ASSUME_UNREACHABLE("invalid ArrayBufferView type");
  1.2631 +}
  1.2632 +
  1.2633 +JS_FRIEND_API(int8_t *)
  1.2634 +JS_GetInt8ArrayData(JSObject *obj)
  1.2635 +{
  1.2636 +    obj = CheckedUnwrap(obj);
  1.2637 +    if (!obj)
  1.2638 +        return nullptr;
  1.2639 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2640 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_INT8);
  1.2641 +    return static_cast<int8_t *>(tarr->viewData());
  1.2642 +}
  1.2643 +
  1.2644 +JS_FRIEND_API(uint8_t *)
  1.2645 +JS_GetUint8ArrayData(JSObject *obj)
  1.2646 +{
  1.2647 +    obj = CheckedUnwrap(obj);
  1.2648 +    if (!obj)
  1.2649 +        return nullptr;
  1.2650 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2651 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_UINT8);
  1.2652 +    return static_cast<uint8_t *>(tarr->viewData());
  1.2653 +}
  1.2654 +
  1.2655 +JS_FRIEND_API(uint8_t *)
  1.2656 +JS_GetUint8ClampedArrayData(JSObject *obj)
  1.2657 +{
  1.2658 +    obj = CheckedUnwrap(obj);
  1.2659 +    if (!obj)
  1.2660 +        return nullptr;
  1.2661 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2662 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_UINT8_CLAMPED);
  1.2663 +    return static_cast<uint8_t *>(tarr->viewData());
  1.2664 +}
  1.2665 +
  1.2666 +JS_FRIEND_API(int16_t *)
  1.2667 +JS_GetInt16ArrayData(JSObject *obj)
  1.2668 +{
  1.2669 +    obj = CheckedUnwrap(obj);
  1.2670 +    if (!obj)
  1.2671 +        return nullptr;
  1.2672 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2673 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_INT16);
  1.2674 +    return static_cast<int16_t *>(tarr->viewData());
  1.2675 +}
  1.2676 +
  1.2677 +JS_FRIEND_API(uint16_t *)
  1.2678 +JS_GetUint16ArrayData(JSObject *obj)
  1.2679 +{
  1.2680 +    obj = CheckedUnwrap(obj);
  1.2681 +    if (!obj)
  1.2682 +        return nullptr;
  1.2683 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2684 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_UINT16);
  1.2685 +    return static_cast<uint16_t *>(tarr->viewData());
  1.2686 +}
  1.2687 +
  1.2688 +JS_FRIEND_API(int32_t *)
  1.2689 +JS_GetInt32ArrayData(JSObject *obj)
  1.2690 +{
  1.2691 +    obj = CheckedUnwrap(obj);
  1.2692 +    if (!obj)
  1.2693 +        return nullptr;
  1.2694 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2695 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_INT32);
  1.2696 +    return static_cast<int32_t *>(tarr->viewData());
  1.2697 +}
  1.2698 +
  1.2699 +JS_FRIEND_API(uint32_t *)
  1.2700 +JS_GetUint32ArrayData(JSObject *obj)
  1.2701 +{
  1.2702 +    obj = CheckedUnwrap(obj);
  1.2703 +    if (!obj)
  1.2704 +        return nullptr;
  1.2705 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2706 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_UINT32);
  1.2707 +    return static_cast<uint32_t *>(tarr->viewData());
  1.2708 +}
  1.2709 +
  1.2710 +JS_FRIEND_API(float *)
  1.2711 +JS_GetFloat32ArrayData(JSObject *obj)
  1.2712 +{
  1.2713 +    obj = CheckedUnwrap(obj);
  1.2714 +    if (!obj)
  1.2715 +        return nullptr;
  1.2716 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2717 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_FLOAT32);
  1.2718 +    return static_cast<float *>(tarr->viewData());
  1.2719 +}
  1.2720 +
  1.2721 +JS_FRIEND_API(double *)
  1.2722 +JS_GetFloat64ArrayData(JSObject *obj)
  1.2723 +{
  1.2724 +    obj = CheckedUnwrap(obj);
  1.2725 +    if (!obj)
  1.2726 +        return nullptr;
  1.2727 +    TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
  1.2728 +    JS_ASSERT(tarr->type() == ArrayBufferView::TYPE_FLOAT64);
  1.2729 +    return static_cast<double *>(tarr->viewData());
  1.2730 +}
  1.2731 +
  1.2732 +JS_FRIEND_API(bool)
  1.2733 +JS_IsDataViewObject(JSObject *obj)
  1.2734 +{
  1.2735 +    obj = CheckedUnwrap(obj);
  1.2736 +    return obj ? obj->is<DataViewObject>() : false;
  1.2737 +}
  1.2738 +
  1.2739 +JS_FRIEND_API(uint32_t)
  1.2740 +JS_GetDataViewByteOffset(JSObject *obj)
  1.2741 +{
  1.2742 +    obj = CheckedUnwrap(obj);
  1.2743 +    if (!obj)
  1.2744 +        return 0;
  1.2745 +    return obj->as<DataViewObject>().byteOffset();
  1.2746 +}
  1.2747 +
  1.2748 +JS_FRIEND_API(void *)
  1.2749 +JS_GetDataViewData(JSObject *obj)
  1.2750 +{
  1.2751 +    obj = CheckedUnwrap(obj);
  1.2752 +    if (!obj)
  1.2753 +        return nullptr;
  1.2754 +    return obj->as<DataViewObject>().dataPointer();
  1.2755 +}
  1.2756 +
  1.2757 +JS_FRIEND_API(uint32_t)
  1.2758 +JS_GetDataViewByteLength(JSObject *obj)
  1.2759 +{
  1.2760 +    obj = CheckedUnwrap(obj);
  1.2761 +    if (!obj)
  1.2762 +        return 0;
  1.2763 +    return obj->as<DataViewObject>().byteLength();
  1.2764 +}

mercurial