Use V8 implementation of TypedArrays and DataView in Blink

Use V8 implementation of TypedArrays and DataView in Blink

R=jochen@chromium.org,kbr@chromium.org
BUG=259731
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=154741

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=155611

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=155697

[Dmitry Lomov (no reviews), 2013-07-15 16:58:05]

Ken/Jochen,
please take a look. This is not a small CL :(

It is not yet landable - I need a V8 roll.

https://codereview.chromium.org/19230002/diff/1/LayoutTests/TestExpectations
File LayoutTests/TestExpectations (right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/TestExpectations#...
LayoutTests/TestExpectations:320: crbug.com/260241 [ Linux ]
inspector/profiler/memory-instrumentation-external-array.html [ Failure Pass ]
See bug for explanations. Only for linux since there is also another expectation
below for Win/Mac

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
File LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt (left):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt:8: PASS new
Uint8ClampedArray(1) instanceof Uint8Array is true
Uint8ClampedArray is not a sub-type of Uint8Array either in ES6 spec or in
Firefox

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (left):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:128: shouldBe('new
Uint8ClampedArray(1) instanceof Uint8Array', 'true');
Uint8ClampedArray is not a sub-type of Uint8Array either in ES6 spec or in
Firefox

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:345:
assertEq('array.BYTES_PER_ELEMENT', elementSizeInBytes,
array.BYTES_PER_ELEMENT);
BYTES_PER_ELEMENT is a property on prototype, not on the constructor (per ES6
spec and in Firefox)

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:660: */
Huge arrays are a problem.
Per ES6 spec, if typed array cannot be allocated, the constructor should throw
RanegError.
The problem is, Blink's tcmalloc always crash when allocation fails.
In current Blink implementation, this problem is swept under the rug by
requiring that buffer size fits in int32. Therefor this test pass, but if
webpage try to allocate a little less than 2 Gb this size will fit in int32 but
the page will 'aw snap'.

This new implementation will always crash when allocation fails. The better
solution will be to use a different malloc for ArrayBuffers (i.e. in
wtf::ArrayBufferContents::allocateMemory) that does not crash on out of memory.
I suggest fixing this in subsequent work.

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
File
LayoutTests/fast/canvas/webgl/script-tests/arraybuffer-transfer-of-control.js
(right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/script-tests/arraybuffer-transfer-of-control.js:16:
["Uint8Clamped", Uint8ClampedArray, 1],
This is added because Uint8ClampedArray is not a subtype of Uint8Array.

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/script-tests/arraybuffer-transfer-of-control.js:119:
view.set([0], 1);
This test didn't test what it thought it tested: vise.set(0, 1) always throws
"Invalid argument" exception.

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
File LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html (right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/canvas/webgl...
LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html:60: */
See huge array comment elsewhere

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/construct...
File LayoutTests/fast/js/constructor-length-expected.txt (right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/construct...
LayoutTests/fast/js/constructor-length-expected.txt:15: PASS DataView.length is
3
This and below as per ES6 spec.

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/construct...
File LayoutTests/fast/js/constructor-length.html (right):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/construct...
LayoutTests/fast/js/constructor-length.html:19: shouldBe('DataView.length',
'3');
This and below as per ES6 spec

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/resources...
File LayoutTests/fast/js/resources/getOwnPropertyDescriptor.js (left):

https://codereview.chromium.org/19230002/diff/1/LayoutTests/fast/js/resources...
LayoutTests/fast/js/resources/getOwnPropertyDescriptor.js:55:
descriptorShouldBe("canvasPixelArray", "'length'", {writable: false, enumerable:
true, configurable: false, value:"canvasPixelArray.length"});
These properties are not object's own - they are on the prototype per ES6 spec.

[jochen (gone - plz use gerrit), 2013-07-16 08:53:57]

I'm deferring to Ken. Basically, the approach with the templates looks sane.

I'm not sure it's worth replacing the malloc just to throw an exception. We also
crash in all other places in the renderer when we run out of memory

https://codereview.chromium.org/19230002/diff/10001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):

https://codereview.chromium.org/19230002/diff/10001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:1004: //   
testConstructionOfHugeArray(type, name, testCase.elementSizeInBytes);
can you move this to a separate layout test and mark it as "Crash"?

[Dmitry Lomov (no reviews), 2013-07-16 13:05:48]

https://codereview.chromium.org/19230002/diff/10001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):

https://codereview.chromium.org/19230002/diff/10001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:1004: //   
testConstructionOfHugeArray(type, name, testCase.elementSizeInBytes);
On 2013/07/16 08:53:57, jochen wrote:
> can you move this to a separate layout test and mark it as "Crash"?

Done.

[Ken Russell (switch to Gerrit), 2013-07-17 03:01:35]

This is awesome work. A couple of high-level concerns about compatibility that
must be addressed before landing, though.

https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (left):

https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:128: shouldBe('new
Uint8ClampedArray(1) instanceof Uint8Array', 'true');
This is problematic and needs to be resolved. The typed array spec defines
Uint8ClampedArray as a subtype of Uint8Array for good reason -- if there are
APIs that take Uint8Array, they should also take Uint8ClampedArray. This issue
needs to be raised with TC39.

https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):

https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:345:
assertEq('array.BYTES_PER_ELEMENT', elementSizeInBytes,
array.BYTES_PER_ELEMENT);
This is a major compatibility problem. BYTES_PER_ELEMENT must be defined as a
property on the constructor function, not on the prototype, per the typed array
spec. The ES6 spec must be updated.

https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
File Source/bindings/v8/custom/V8ArrayBufferViewCustom.cpp (right):

https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
Source/bindings/v8/custom/V8ArrayBufferViewCustom.cpp:52: if
(object->IsUint8Array()) {
If the Uint8Array/Uint8ClampedArray inheritance issue is resolved so that
Uint8ClampedArray inherits from Uint8Array, will the Uint8ClampedArray test have
to come before the Uint8Array test?

https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
File Source/bindings/v8/custom/V8TypedArrayCustom.h (right):

https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
Source/bindings/v8/custom/V8TypedArrayCustom.h:13: * THIS SOFTWARE IS PROVIDED
BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
The copyright notice on the new files is wrong -- it shouldn't be referencing
Apple, Inc. Look to newly added files for the recommended style.

[Dmitry Lomov (no reviews), 2013-07-17 09:44:53]

My approach to resolving compatibility issues is, of the following 3:
 1. ES6 spec
 2. Blink/WebKit
 3. Firefox
I implement the majority opinion (if two of them agree, I do what they do).

That is why I have not made Uint8ClampedArray inherit from Uint8Array. Repeating
the discussion offline, conceptually, Uint8ClampedArray is not a proper
sub-category of Uint8Array, because it redefines indexed setter in incompatible
manner, so you cannot use Uint8ClampedArray anywhere Uint8Array is used. 

The proper hierarchy here would be
   Uint8ReadOnlyArray (getter, no setter)
     Uint8Array (setter with narrowing semantics)
     Uint8ClampedArray (setter with clamping semantics)
but I do not think introducing this is worthwhile.

The web breakage due to this is unlikely since Firefox does not implement that
(i.e. Firefox and ES6 agree).

For BYTES_PER_ELEMENT, my bad - I just realized that Firefox put the property on
a constructor function too - will fix.


On 2013/07/17 03:01:35, Ken Russell wrote:
> This is awesome work. A couple of high-level concerns about compatibility that
> must be addressed before landing, though.
> 
>
https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
> File LayoutTests/fast/canvas/webgl/array-unit-tests.html (left):
> 
>
https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
> LayoutTests/fast/canvas/webgl/array-unit-tests.html:128: shouldBe('new
> Uint8ClampedArray(1) instanceof Uint8Array', 'true');
> This is problematic and needs to be resolved. The typed array spec defines
> Uint8ClampedArray as a subtype of Uint8Array for good reason -- if there are
> APIs that take Uint8Array, they should also take Uint8ClampedArray. This issue
> needs to be raised with TC39.
> 
>
https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
> File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):
> 
>
https://codereview.chromium.org/19230002/diff/18001/LayoutTests/fast/canvas/w...
> LayoutTests/fast/canvas/webgl/array-unit-tests.html:345:
> assertEq('array.BYTES_PER_ELEMENT', elementSizeInBytes,
> array.BYTES_PER_ELEMENT);
> This is a major compatibility problem. BYTES_PER_ELEMENT must be defined as a
> property on the constructor function, not on the prototype, per the typed
array
> spec. The ES6 spec must be updated.
> 
>
https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
> File Source/bindings/v8/custom/V8ArrayBufferViewCustom.cpp (right):
> 
>
https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
> Source/bindings/v8/custom/V8ArrayBufferViewCustom.cpp:52: if
> (object->IsUint8Array()) {
> If the Uint8Array/Uint8ClampedArray inheritance issue is resolved so that
> Uint8ClampedArray inherits from Uint8Array, will the Uint8ClampedArray test
have
> to come before the Uint8Array test?
> 
>
https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
> File Source/bindings/v8/custom/V8TypedArrayCustom.h (right):
> 
>
https://codereview.chromium.org/19230002/diff/18001/Source/bindings/v8/custom...
> Source/bindings/v8/custom/V8TypedArrayCustom.h:13: * THIS SOFTWARE IS PROVIDED
> BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
> The copyright notice on the new files is wrong -- it shouldn't be referencing
> Apple, Inc. Look to newly added files for the recommended style.

[Dmitry Lomov (no reviews), 2013-07-17 12:13:08]

BYTES_PER_ELEMENT issue is fixed in V8 bleeding_edge
(https://code.google.com/p/v8/source/detail?r=15712).
Also updated copyright notices.

[Ken Russell (switch to Gerrit), 2013-07-19 20:31:36]

LGTM

https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (left):

https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:128: shouldBe('new
Uint8ClampedArray(1) instanceof Uint8Array', 'true');
Now that this has been resolved via offline discussion, please feel free to pull
the latest version of this test from https://github.com/KhronosGroup/WebGL ,
which actually asserts that Uint8ClampedArray does not inherit from Uint8Array.

[Dmitry Lomov (no reviews), 2013-07-19 23:49:14]

On 2013/07/19 20:31:36, Ken Russell wrote:
> LGTM
> 
>
https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
> File LayoutTests/fast/canvas/webgl/array-unit-tests.html (left):
> 
>
https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
> LayoutTests/fast/canvas/webgl/array-unit-tests.html:128: shouldBe('new
> Uint8ClampedArray(1) instanceof Uint8Array', 'true');
> Now that this has been resolved via offline discussion, please feel free to
pull
> the latest version of this test from https://github.com/KhronosGroup/WebGL ,
> which actually asserts that Uint8ClampedArray does not inherit from
Uint8Array.

Note that there is another change to this test, the one related to huge arrays. 
I definitely like that this test is exactly the webgl conformance spec test word
for word. Ideas?

[Ken Russell (switch to Gerrit), 2013-07-20 01:37:44]

> Note that there is another change to this test, the one related to huge
arrays. 
> I definitely like that this test is exactly the webgl conformance spec test
word
> for word. Ideas?

As discussed offline, please send a pull request against Khronos' github
repository, and let's refactor the tests there.

https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
File LayoutTests/fast/canvas/webgl/array-unit-tests.html (right):

https://codereview.chromium.org/19230002/diff/28001/LayoutTests/fast/canvas/w...
LayoutTests/fast/canvas/webgl/array-unit-tests.html:648: function
testConstructionOfHugeArray(type, name, sz) {
This should be deleted.

[commit-bot: I haz the power, 2013-07-22 18:29:37]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/38001

[commit-bot: I haz the power, 2013-07-22 18:29:49]

Failed to apply patch for Source/bindings/v8/custom/V8CryptoCustom.cpp:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file Source/bindings/v8/custom/V8CryptoCustom.cpp
  Hunk #1 FAILED at 25.
  1 out of 1 hunk FAILED -- saving rejects to file
Source/bindings/v8/custom/V8CryptoCustom.cpp.rej

Patch:       Source/bindings/v8/custom/V8CryptoCustom.cpp
Index: Source/bindings/v8/custom/V8CryptoCustom.cpp
diff --git a/Source/bindings/v8/custom/V8CryptoCustom.cpp
b/Source/bindings/v8/custom/V8CryptoCustom.cpp
index
1d44dee57fe00ac4bfb6899c7a4a4bb4affea5ca..48e34ff8c0937adddb7ea39e4e9ed7c654622bcc
100644
--- a/Source/bindings/v8/custom/V8CryptoCustom.cpp
+++ b/Source/bindings/v8/custom/V8CryptoCustom.cpp
@@ -25,9 +25,9 @@
 #include "config.h"
 #include "V8Crypto.h"
 
-#include "V8ArrayBufferView.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8Utilities.h"
+#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
 #include "core/dom/ExceptionCode.h"
 #include "modules/crypto/Crypto.h"

[commit-bot: I haz the power, 2013-07-22 19:01:28]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/41001

[commit-bot: I haz the power, 2013-07-22 19:20:04]

Retried try job too often on blink_presubmit for step(s) presubmit
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=blink_pres...

[jochen (gone - plz use gerrit), 2013-07-23 07:20:58]

lgtm

[commit-bot: I haz the power, 2013-07-23 07:44:15]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/50001

[commit-bot: I haz the power, 2013-07-23 09:16:30]

Change committed as 154741

[commit-bot: I haz the power, 2013-08-06 11:20:59]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/69001

[commit-bot: I haz the power, 2013-08-06 13:45:03]

Change committed as 155611

[Stephen White, 2013-08-06 15:19:16]

On 2013/08/06 13:45:03, I haz the power (commit-bot) wrote:
> Change committed as 155611

This patch seems to be causing intermittent crashes in webaudio tests.  E.g.,
http://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux/builds/15532.

I can repro locally by running the webaudio tests 2-3 times. After reverting,
they pass.

[Dmitry Lomov (no reviews), 2013-08-07 11:16:26]

On 2013/08/06 15:19:16, Stephen White wrote:
> On 2013/08/06 13:45:03, I haz the power (commit-bot) wrote:
> > Change committed as 155611
> 
> This patch seems to be causing intermittent crashes in webaudio tests.  E.g.,
>
http://build.chromium.org/p/chromium.webkit/builders/WebKit%2520Linux/builds/....
> 
> I can repro locally by running the webaudio tests 2-3 times. After reverting,
> they pass.

Fixed in v8 r16084 (https://code.google.com/p/v8/source/detail?r=16084). Will
re-land once it rools

[commit-bot: I haz the power, 2013-08-07 13:33:11]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/69001

[commit-bot: I haz the power, 2013-08-07 13:33:31]

Failed to apply patch for Source/bindings/v8/ScriptProfiler.cpp:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file Source/bindings/v8/ScriptProfiler.cpp
  Hunk #3 FAILED at 320.
  1 out of 3 hunks FAILED -- saving rejects to file
Source/bindings/v8/ScriptProfiler.cpp.rej

Patch:       Source/bindings/v8/ScriptProfiler.cpp
Index: Source/bindings/v8/ScriptProfiler.cpp
diff --git a/Source/bindings/v8/ScriptProfiler.cpp
b/Source/bindings/v8/ScriptProfiler.cpp
index
1e34ad85db8dc35c1d5fe7c390d54095ef519cb8..e7c30bb41047e365878d45d3726c72344185bafb
100644
--- a/Source/bindings/v8/ScriptProfiler.cpp
+++ b/Source/bindings/v8/ScriptProfiler.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "bindings/v8/ScriptProfiler.h"
 
-#include "V8ArrayBufferView.h"
 #include "V8Node.h"
 #include "V8Window.h"
 #include "bindings/v8/RetainedDOMInfo.h"
@@ -39,6 +38,7 @@
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMWrapper.h"
 #include "bindings/v8/WrapperTypeInfo.h"
+#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
 #include "core/dom/Document.h"
 #include "core/inspector/BindingVisitors.h"
 
@@ -320,7 +320,7 @@ void
ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
             // GCd during visiting.
            
ASSERT((*reinterpret_cast<v8::Handle<v8::Value>*>(value))->IsObject());
             v8::Handle<v8::Object>* wrapper =
reinterpret_cast<v8::Handle<v8::Object>*>(value);
-            if
(!toWrapperTypeInfo(*wrapper)->isSubclass(&V8ArrayBufferView::info))
+            if (!(*wrapper)->IsArrayBufferView())
                 return;
            
m_visitor->visitJSExternalArray(V8ArrayBufferView::toNative(*wrapper));
         }

[commit-bot: I haz the power, 2013-08-07 13:42:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/69001

[commit-bot: I haz the power, 2013-08-07 13:43:41]

Failed to apply patch for Source/bindings/v8/ScriptProfiler.cpp:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file Source/bindings/v8/ScriptProfiler.cpp
  Hunk #3 FAILED at 320.
  1 out of 3 hunks FAILED -- saving rejects to file
Source/bindings/v8/ScriptProfiler.cpp.rej

Patch:       Source/bindings/v8/ScriptProfiler.cpp
Index: Source/bindings/v8/ScriptProfiler.cpp
diff --git a/Source/bindings/v8/ScriptProfiler.cpp
b/Source/bindings/v8/ScriptProfiler.cpp
index
1e34ad85db8dc35c1d5fe7c390d54095ef519cb8..e7c30bb41047e365878d45d3726c72344185bafb
100644
--- a/Source/bindings/v8/ScriptProfiler.cpp
+++ b/Source/bindings/v8/ScriptProfiler.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "bindings/v8/ScriptProfiler.h"
 
-#include "V8ArrayBufferView.h"
 #include "V8Node.h"
 #include "V8Window.h"
 #include "bindings/v8/RetainedDOMInfo.h"
@@ -39,6 +38,7 @@
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMWrapper.h"
 #include "bindings/v8/WrapperTypeInfo.h"
+#include "bindings/v8/custom/V8ArrayBufferViewCustom.h"
 #include "core/dom/Document.h"
 #include "core/inspector/BindingVisitors.h"
 
@@ -320,7 +320,7 @@ void
ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
             // GCd during visiting.
            
ASSERT((*reinterpret_cast<v8::Handle<v8::Value>*>(value))->IsObject());
             v8::Handle<v8::Object>* wrapper =
reinterpret_cast<v8::Handle<v8::Object>*>(value);
-            if
(!toWrapperTypeInfo(*wrapper)->isSubclass(&V8ArrayBufferView::info))
+            if (!(*wrapper)->IsArrayBufferView())
                 return;
            
m_visitor->visitJSExternalArray(V8ArrayBufferView::toNative(*wrapper));
         }

[commit-bot: I haz the power, 2013-08-07 13:53:58]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dslomov@chromium.org/19230002/83002

[commit-bot: I haz the power, 2013-08-07 15:39:46]

Change committed as 155697