1 files changed, 19 insertions, 5 deletions
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferView.h b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
index 3feb03b72..769150b36 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferView.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferView.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -93,6 +93,7 @@ inline bool hasArrayBuffer(TypedArrayMode mode)
 class JSArrayBufferView : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames | OverridesGetOwnPropertySlot;
     
     static const unsigned fastSizeLimit = 1000;
     
@@ -158,9 +159,18 @@ public:
     
     ArrayBuffer* buffer();
     PassRefPtr<ArrayBufferView> impl();
+    bool isNeutered() { return hasArrayBuffer() && !vector(); }
     void neuter();
     
-    void* vector() { return m_vector; }
+    void* vector()
+    {
+        return m_vector.getPredicated(
+            this,
+            [this] () -> bool {
+                return mode() == FastTypedArray;
+            });
+    }
+    
     unsigned byteOffset();
     unsigned length() const { return m_length; }
 
@@ -174,16 +184,20 @@ private:
     static void finalize(JSCell*);
 
 protected:
-    static const unsigned StructureFlags = OverridesGetPropertyNames | OverridesGetOwnPropertySlot | Base::StructureFlags;
-    
     ArrayBuffer* existingBufferInButterfly();
 
-    void* m_vector;
+    CopyBarrier<char> m_vector; // this is really a void*, but void would not work here.
     uint32_t m_length;
     TypedArrayMode m_mode;
 };
 
 } // namespace JSC
 
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::TypedArrayMode);
+
+} // namespace WTF
+
 #endif // JSArrayBufferView_h