Merge 104736 - [v8] Int16Array.set(array, offset) fails on first execution

Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 33 matching lines @@
 // Check if the JavaScript 'set' method was already installed
 // on the prototype of the given typed array.
 bool fastSetInstalled(v8::Handle<v8::Object> array);
 
 // Install the JavaScript 'set' method on the prototype of
 // the given typed array.
 void installFastSet(v8::Handle<v8::Object> array);
 
 // Copy the elements from the source array to the typed destination array by
 // invoking the 'set' method of the destination array in JS.
-void copyElements(v8::Handle<v8::Object> destArray, v8::Handle<v8::Object> srcArray);
+void copyElements(v8::Handle<v8::Object> destArray, v8::Handle<v8::Object> srcArray, uint32_t offset);
 
 
 // Template function used by the ArrayBufferView*Constructor callbacks.
 template<class ArrayClass, class ElementType>
 v8::Handle<v8::Value> constructWebGLArrayWithArrayBufferArgument(const v8::Arguments& args, WrapperTypeInfo* type, v8::ExternalArrayType arrayType, bool hasIndexer)
 {
     ArrayBuffer* buf = V8ArrayBuffer::toNative(args[0]->ToObject());
     if (!buf)
         return throwError("Could not convert argument 0 to a ArrayBuffer");
     bool ok;
@@ skipping 99 matching lines @@
         array = ArrayClass::create(len);
     if (!array.get())
         return throwError("ArrayBufferView size is not a small enough positive integer.", V8Proxy::RangeError);
 
 
     // Transform the holder into a wrapper object for the array.
     V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
     args.Holder()->SetIndexedPropertiesToExternalArrayData(array.get()->baseAddress(), arrayType, array.get()->length());
 
     if (!srcArray.IsEmpty())
-        copyElements(args.Holder(), srcArray);
+        copyElements(args.Holder(), srcArray, 0);
 
     return toV8(array.release(), args.Holder(), MarkIndependent);
 }
 
 template <class CPlusPlusArrayType, class JavaScriptWrapperArrayType>
 v8::Handle<v8::Value> setWebGLArrayHelper(const v8::Arguments& args)
 {
     if (args.Length() < 1) {
         V8Proxy::setDOMException(SYNTAX_ERR);
         return notHandledByInterceptor();
@@ skipping 20 matching lines @@
             offset = toUInt32(args[1]);
         uint32_t length = toUInt32(array->Get(v8::String::New("length")));
         if (offset > impl->length()
             || offset + length > impl->length()
             || offset + length < offset)
             // Out of range offset or overflow
             V8Proxy::setDOMException(INDEX_SIZE_ERR);
         else {
             if (!fastSetInstalled(args.Holder())) {
                 installFastSet(args.Holder());
-                copyElements(args.Holder(), array);
+                copyElements(args.Holder(), array, offset);
             } else {
                 for (uint32_t i = 0; i < length; i++)
                     impl->set(offset + i, array->Get(i)->NumberValue());
             }
         }
         return v8::Undefined();
     }
 
     V8Proxy::setDOMException(SYNTAX_ERR);
     return notHandledByInterceptor();
 }
 
 }
 
 #endif // V8ArrayBufferViewCustom_h