Merge 139459

Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h

Index: Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
===================================================================
--- Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h	(revision 139639)
+++ Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h	(working copy)
@@ -171,7 +171,12 @@
         srcArray = args[0]->ToObject();
         if (srcArray.IsEmpty())
             return throwTypeError("Could not convert argument 0 to an array", args.GetIsolate());
-        len = toUInt32(srcArray->Get(v8::String::NewSymbol("length")));
+        v8::Local<v8::Value> val = srcArray->Get(v8::String::NewSymbol("length"));
+        if (val.IsEmpty()) {
+            // Exception thrown during fetch of length property.
+            return v8Undefined();
+        }
+        len = toUInt32(val);
         doInstantiation = true;
     } else {
         bool ok = false;
@@ -208,8 +213,14 @@
     if (!srcArray.IsEmpty()) {
         bool copied = copyElements(args.Holder(), srcArray, len, 0, args.GetIsolate());
         if (!copied) {
-            for (unsigned i = 0; i < len; i++)
-                array->set(i, srcArray->Get(i)->NumberValue());
+            for (unsigned i = 0; i < len; i++) {
+                v8::Local<v8::Value> val = srcArray->Get(i);
+                if (val.IsEmpty()) {
+                    // Exception thrown during fetch.
+                    return v8Undefined();
+                }
+                array->set(i, val->NumberValue());
+            }
         }
     }