From ccaf2695e7e746bbe18f1db0888fbcf12a013624 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Tue, 6 May 2014 10:40:04 -0700
Subject: [PATCH] Bug 1003997.  r=sfink

---
 js/src/vm/ArrayBufferObject.cpp | 4 +++-
 js/src/vm/TypedArrayObject.h    | 3 +--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index cee3573d858d..3982a56b1423 100644
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -970,8 +970,10 @@ ArrayBufferViewObject::bufferObject(JSContext *cx, Handle<ArrayBufferViewObject
         Rooted<TypedArrayObject *> typedArray(cx, &thisObject->as<TypedArrayObject>());
         if (!TypedArrayObject::ensureHasBuffer(cx, typedArray))
             return nullptr;
+        return thisObject->as<TypedArrayObject>().buffer();
     }
-    return &thisObject->getFixedSlot(BUFFER_SLOT).toObject().as<ArrayBufferObject>();
+    MOZ_ASSERT(thisObject->is<DataViewObject>());
+    return &thisObject->as<DataViewObject>().arrayBuffer();
 }
 
 /* JS Friend API */
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index b904f829a94f..bc07337566c1 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -367,8 +367,7 @@ template <>
 inline bool
 JSObject::is<js::ArrayBufferViewObject>() const
 {
-    return is<js::DataViewObject>() || is<js::TypedArrayObject>() ||
-           IsTypedObjectClass(getClass());
+    return is<js::DataViewObject>() || is<js::TypedArrayObject>();
 }
 
 #endif /* vm_TypedArrayObject_h */