Bug 1970154 - Streams Realm Handling Improvements r=saschanaz,jonco, a=dsmith DONTBUILD

Make TransferArrayBuffer cautious, and remove overzealous assert in JS_GetArrayBufferViewBuffer

Differential Revision: https://phabricator.services.mozilla.com/D253288

dom/streams/ByteStreamHelpers.cpp

@@ -16,23 +16,35 @@ namespace mozilla::dom {
 // https://streams.spec.whatwg.org/#transfer-array-buffer
 // As some parts of the specifcation want to use the abrupt completion value,
 // this function may leave a pending exception if it returns nullptr.
+//
+// This can be called with a CCW to an ArrayBuffer Object as we handle the
+// case explicitly.
 JSObject* TransferArrayBuffer(JSContext* aCx, JS::Handle<JSObject*> aObject) {
-  MOZ_ASSERT(JS::IsArrayBufferObject(aObject));
+  JS::Rooted<JSObject*> unwrappedObj(aCx, JS::UnwrapArrayBuffer(aObject));
+  if (!unwrappedObj) {
+    js::ReportAccessDenied(aCx);
+    return nullptr;
+  }
+
+  size_t bufferLength = 0;
+  UniquePtr<void, JS::FreePolicy> bufferData;
+  {
+    JSAutoRealm ar(aCx, unwrappedObj);
 
     // Step 1.
-  MOZ_ASSERT(!JS::IsDetachedArrayBufferObject(aObject));
+    MOZ_ASSERT(!JS::IsDetachedArrayBufferObject(unwrappedObj));
 
     // Step 3 (Reordered)
-  size_t bufferLength = JS::GetArrayBufferByteLength(aObject);
+    bufferLength = JS::GetArrayBufferByteLength(unwrappedObj);
 
     // Step 2 (Reordered)
-  UniquePtr<void, JS::FreePolicy> bufferData{
-      JS::StealArrayBufferContents(aCx, aObject)};
+    bufferData.reset(JS::StealArrayBufferContents(aCx, unwrappedObj));
 
     // Step 4.
-  if (!JS::DetachArrayBuffer(aCx, aObject)) {
+    if (!JS::DetachArrayBuffer(aCx, unwrappedObj)) {
       return nullptr;
     }
+  }
 
   // Step 5.
   return JS::NewArrayBufferWithContents(aCx, bufferLength,

js/src/vm/ArrayBufferViewObject.cpp

@@ -450,7 +450,6 @@ JS_PUBLIC_API JSObject* JS_GetArrayBufferViewBuffer(JSContext* cx,
                                                     bool* isSharedMemory) {
   AssertHeapIsIdle();
   CHECK_THREAD(cx);
-  cx->check(obj);
 
   Rooted<ArrayBufferViewObject*> unwrappedView(
       cx, obj->maybeUnwrapAs<ArrayBufferViewObject>());