Merge 91803 - Float32Array(ArrayBuffer, index, length) constructor working incorrectly.

Source/WebCore/bindings/js/JSArrayBufferViewHelper.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 75 matching lines @@
 // Template function used by XXXArrayConstructors.
 // If this returns 0, it will already have thrown a JavaScript exception.
 template<class C, typename T>
 PassRefPtr<C> constructArrayBufferViewWithArrayBufferArgument(JSC::ExecState* exec)
 {
     RefPtr<ArrayBuffer> buffer = toArrayBuffer(exec->argument(0));
     if (!buffer)
         return 0;
 
     unsigned offset = (exec->argumentCount() > 1) ? exec->argument(1).toUInt32(exec) : 0;
-    if ((buffer->byteLength() - offset) % sizeof(T))
-        throwError(exec, createRangeError(exec, "ArrayBuffer length minus the byteOffset is not a multiple of the element size."));
-    unsigned int length = (buffer->byteLength() - offset) / sizeof(T);
+    unsigned int length = 0;
     if (exec->argumentCount() > 2)
         length = exec->argument(2).toUInt32(exec);
+    else {
+        if ((buffer->byteLength() - offset) % sizeof(T)) {
+            throwError(exec, createRangeError(exec, "ArrayBuffer length minus the byteOffset is not a multiple of the element size."));
+            return 0;
+        }
+        length = (buffer->byteLength() - offset) / sizeof(T);
+    }
     RefPtr<C> array = C::create(buffer, offset, length);
     if (!array)
         setDOMException(exec, INDEX_SIZE_ERR);
     return array;
 }
 
 template<class C, typename T>
 PassRefPtr<C> constructArrayBufferView(JSC::ExecState* exec)
 {
     // There are 3 constructors:
@@ skipping 55 matching lines @@
     if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), object))
         return wrapper;
 
     exec->heap()->reportExtraMemoryCost(object->byteLength());
     return createWrapper<JSType>(exec, globalObject, object);
 }
 
 } // namespace WebCore
 
 #endif // JSArrayBufferViewHelper_h