Bug 1872555: Transfer can only realloc when the jemalloc arena is known. r=sfink
commit19b4834914334ee7916c8f648bb2c5c4f6f6eada
authorAndré Bargull <andre.bargull@gmail.com>
Wed, 24 Jan 2024 12:42:16 +0000 (24 12:42 +0000)
committerAndré Bargull <andre.bargull@gmail.com>
Wed, 24 Jan 2024 12:42:16 +0000 (24 12:42 +0000)
treee9239937ea21aba9bf5972a03eedf5420ea951b7
parent12002be1facd65d37897156688692e6be4b57ca9
Bug 1872555: Transfer can only realloc when the jemalloc arena is known. r=sfink

`ArrayBufferObject::copyAndDetachRealloc()` calls `ReallocateArrayBufferContents`
to realloc the source buffer into `ArrayBufferContentsArena`. This is only valid
when the source buffer was also created in `ArrayBufferContentsArena`.

To track if the ArrayBuffer contents were allocated in `ArrayBufferContentsArena`,
split `BufferKind::MALLOCED` into `MALLOCED_ARRAYBUFFER_CONTENTS_ARENA` and
`MALLOCED_UNKNOWN_ARENA`.

Differential Revision: https://phabricator.services.mozilla.com/D197492
js/src/jit-test/tests/typedarray/arraybuffer-transfer-unknown-arena.js [new file with mode: 0644]
js/src/shell/js.cpp
js/src/vm/ArrayBufferObject.cpp
js/src/vm/ArrayBufferObject.h
js/src/vm/StructuredClone.cpp