From 32b99ebba8c88e832b7f56d86cff819b1fa97b5e Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Thu, 30 Aug 2012 11:39:42 -0400
Subject: [PATCH] Bug 786903 - restore typedArray(otherTypedArray)
 initialization fastpath; r=sfink

---
 js/src/jstypedarray.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 88122ae9af9..5d52be3fae1 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -1726,8 +1726,11 @@ class TypedArrayTemplate
     fromArray(JSContext *cx, HandleObject other)
     {
         uint32_t len;
-        if (!GetLengthProperty(cx, other, &len))
+        if (other->isTypedArray()) {
+            len = length(other);
+        } else if (!GetLengthProperty(cx, other, &len)) {
             return NULL;
+        }
 
         RootedObject bufobj(cx, createBufferWithSizeAndCount(cx, len));
         if (!bufobj)
@@ -1821,6 +1824,9 @@ class TypedArrayTemplate
         JS_ASSERT(thisTypedArrayObj->isTypedArray());
         JS_ASSERT(offset <= length(thisTypedArrayObj));
         JS_ASSERT(len <= length(thisTypedArrayObj) - offset);
+        if (ar->isTypedArray())
+            return copyFromTypedArray(cx, thisTypedArrayObj, ar, offset);
+
         NativeType *dest = static_cast<NativeType*>(viewData(thisTypedArrayObj)) + offset;
         SkipRoot skip(cx, &dest);