new Float32Array(new ArrayBuffer(10), 0, 2) RangeError: ArrayBuffer length minus the byteOffset is not a multiple of the element size. Unless I am misunderstanding the spec, a Float32Array of length 2 should be 8 bytes, enough to fit, and everything should be aligned.
Created attachment 102080 [details] Patch
Comment on attachment 102080 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=102080&action=review I think this is good, just have one question about signed-ness. > Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h:65 > + length = (buf->byteLength() - offset) / sizeof(ElementType); What if offset is bigger than byteLength()?
(In reply to comment #2) > (From update of attachment 102080 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=102080&action=review > > I think this is good, just have one question about signed-ness. > > > Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h:65 > > + length = (buf->byteLength() - offset) / sizeof(ElementType); > > What if offset is bigger than byteLength()? This will be caught by other checks in the C++ code. I'll expand the test case to explicitly check this.
Committed r91803: <http://trac.webkit.org/changeset/91803>