Merge 139459

Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 153 matching lines @@
     }
 
     uint32_t len = 0;
     v8::Handle<v8::Object> srcArray;
     bool doInstantiation = false;
 
     if (args[0]->IsObject()) {
         srcArray = args[0]->ToObject();
         if (srcArray.IsEmpty())
             return throwTypeError("Could not convert argument 0 to an array", args.GetIsolate());
-        len = toUInt32(srcArray->Get(v8::String::NewSymbol("length")));
+        v8::Local<v8::Value> val = srcArray->Get(v8::String::NewSymbol("length"));
+        if (val.IsEmpty()) {
+            // Exception thrown during fetch of length property.
+            return v8Undefined();
+        }
+        len = toUInt32(val);
         doInstantiation = true;
     } else {
         bool ok = false;
         int32_t tempLength = toInt32(args[0], ok); // NaN/+inf/-inf returns 0, this is intended by WebIDL
         if (ok && tempLength >= 0) {
             len = static_cast<uint32_t>(tempLength);
             doInstantiation = true;
         }
     }
 
@@ skipping 16 matching lines @@
         v8::V8::AdjustAmountOfExternalAllocatedMemory(array->byteLength());
     }
 
 
     // Transform the holder into a wrapper object for the array.
     args.Holder()->SetIndexedPropertiesToExternalArrayData(array.get()->baseAddress(), arrayType, array.get()->length());
 
     if (!srcArray.IsEmpty()) {
         bool copied = copyElements(args.Holder(), srcArray, len, 0, args.GetIsolate());
         if (!copied) {
-            for (unsigned i = 0; i < len; i++)
-                array->set(i, srcArray->Get(i)->NumberValue());
+            for (unsigned i = 0; i < len; i++) {
+                v8::Local<v8::Value> val = srcArray->Get(i);
+                if (val.IsEmpty()) {
+                    // Exception thrown during fetch.
+                    return v8Undefined();
+                }
+                array->set(i, val->NumberValue());
+            }
         }
     }
 
     v8::Handle<v8::Object> wrapper = args.Holder();
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::associateObjectWithWrapper(array.release(), type, wrapper);
     wrapperHandle.MarkIndependent();
     return wrapper;
 }
 
 template <class CPlusPlusArrayType, class JavaScriptWrapperArrayType>
@@ skipping 31 matching lines @@
         }
         return v8::Undefined();
     }
 
     return throwTypeError("Invalid argument", args.GetIsolate());
 }
 
 }
 
 #endif // V8ArrayBufferViewCustom_h