Merge 91803 - Float32Array(ArrayBuffer, index, length) constructor working incorrectly.

Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h

Index: Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
===================================================================
--- Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h	(revision 91888)
+++ Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h	(working copy)
@@ -54,15 +54,16 @@
         if (!ok)
             return throwError("Could not convert argument 1 to a number");
     }
-    if ((buf->byteLength() - offset) % sizeof(ElementType))
-        return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
-    uint32_t length = (buf->byteLength() - offset) / sizeof(ElementType);
+    uint32_t length = 0;
     if (argLen > 2) {
         length = toUInt32(args[2], ok);
         if (!ok)
             return throwError("Could not convert argument 2 to a number");
+    } else {
+        if ((buf->byteLength() - offset) % sizeof(ElementType))
+            return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
+        length = (buf->byteLength() - offset) / sizeof(ElementType);
     }
-
     RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
     if (!array) {
         V8Proxy::setDOMException(INDEX_SIZE_ERR);