Merge 91803 - Float32Array(ArrayBuffer, index, length) constructor working incorrectly.

Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 36 matching lines @@
     if (!buf)
         return throwError("Could not convert argument 0 to a ArrayBuffer");
     bool ok;
     uint32_t offset = 0;
     int argLen = args.Length();
     if (argLen > 1) {
         offset = toUInt32(args[1], ok);
         if (!ok)
             return throwError("Could not convert argument 1 to a number");
     }
-    if ((buf->byteLength() - offset) % sizeof(ElementType))
-        return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
-    uint32_t length = (buf->byteLength() - offset) / sizeof(ElementType);
+    uint32_t length = 0;
     if (argLen > 2) {
         length = toUInt32(args[2], ok);
         if (!ok)
             return throwError("Could not convert argument 2 to a number");
+    } else {
+        if ((buf->byteLength() - offset) % sizeof(ElementType))
+            return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
+        length = (buf->byteLength() - offset) / sizeof(ElementType);
     }
-
     RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
     if (!array) {
         V8Proxy::setDOMException(INDEX_SIZE_ERR);
         return notHandledByInterceptor();
     }
     // Transform the holder into a wrapper object for the array.
     V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
     if (hasIndexer)
         args.Holder()->SetIndexedPropertiesToExternalArrayData(array.get()->baseAddress(), arrayType, array.get()->length());
     return toV8(array.release(), args.Holder(), MarkIndependent);
@@ skipping 125 matching lines @@
         return v8::Undefined();
     }
 
     V8Proxy::setDOMException(SYNTAX_ERR);
     return notHandledByInterceptor();
 }
 
 }
 
 #endif // V8ArrayBufferViewCustom_h