webkitgtk-2.12.3webkitgtk-2.12.3

1 files changed, 5 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h b/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
index de4e8587c..3c4b054ba 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
@@ -59,16 +59,18 @@ inline void JSArrayBufferView::neuter()
 {
     ASSERT(hasArrayBuffer());
     m_length = 0;
-    m_vector = 0;
+    m_vector.clear();
 }
 
 inline unsigned JSArrayBufferView::byteOffset()
 {
     if (!hasArrayBuffer())
         return 0;
-    
+
+    ASSERT(!vector() == !buffer()->data());
+
     ptrdiff_t delta =
-        static_cast<uint8_t*>(m_vector) - static_cast<uint8_t*>(buffer()->data());
+        bitwise_cast<uint8_t*>(vector()) - static_cast<uint8_t*>(buffer()->data());
     
     unsigned result = static_cast<unsigned>(delta);
     ASSERT(static_cast<ptrdiff_t>(result) == delta);