Bug 1966355 - Part 19: Ensure immutable array buffers are rejected by WebIDL. r=webidl,saschanaz,edgar

WebIDL integration for immutable array buffers isn't yet defined, so for now
disallow immutable array buffers and views to immutable array buffers.

See also <tc39/proposal-immutable-arraybuffer#43>.

Differential Revision: https://phabricator.services.mozilla.com/D249412

Author: anba

dom/bindings/Codegen.py

@@ -5860,6 +5860,13 @@ def onFailureIsResizable():
             "%s" % (firstCap(sourceDescription), exceptionCode)
         )
 
+    def onFailureIsImmutable():
+        desc = firstCap(sourceDescription)
+        return CGGeneric(
+            f'cx.ThrowErrorMessage<MSG_TYPEDARRAY_IS_IMMUTABLE>("{desc}");\n'
+            f"{exceptionCode}"
+        )
+
     def onFailureNotCallable(failureCode):
         return CGGeneric(
             failureCode
@@ -6897,11 +6904,13 @@ def incrementNestingLevel():
                 isSharedMethod = "JS::IsSharedArrayBufferObject"
                 isLargeMethod = "JS::IsLargeArrayBufferMaybeShared"
                 isResizableMethod = "JS::IsResizableArrayBufferMaybeShared"
+                isImmutableMethod = "JS::IsImmutableArrayBufferMaybeShared"
             else:
                 assert type.isArrayBufferView() or type.isTypedArray()
                 isSharedMethod = "JS::IsArrayBufferViewShared"
                 isLargeMethod = "JS::IsLargeArrayBufferView"
                 isResizableMethod = "JS::IsResizableArrayBufferView"
+                isImmutableMethod = "JS::IsImmutableArrayBufferView"
             if not isAllowShared:
                 template += fill(
                     """
@@ -6939,6 +6948,18 @@ def incrementNestingLevel():
                 objRef=objRef,
                 badType=onFailureIsResizable().define(),
             )
+            # For now reject immutable ArrayBuffers. Supporting this will
+            # require changing dom::TypedArray and consumers.
+            template += fill(
+                """
+                if (${isImmutableMethod}(${objRef}.Obj())) {
+                  $*{badType}
+                }
+                """,
+                isImmutableMethod=isImmutableMethod,
+                objRef=objRef,
+                badType=onFailureIsImmutable().define(),
+            )
         template = wrapObjectTemplate(
             template, type, "${declName}.SetNull();\n", failureCode
         )

dom/bindings/Errors.msg

@@ -75,6 +75,7 @@ MSG_DEF(MSG_SW_SCRIPT_THREW, 3, true, JSEXN_TYPEERR, "{0}ServiceWorker script at
 MSG_DEF(MSG_TYPEDARRAY_IS_SHARED, 2, true, JSEXN_TYPEERR, "{0}{1} can't be a SharedArrayBuffer or an ArrayBufferView backed by a SharedArrayBuffer")
 MSG_DEF(MSG_TYPEDARRAY_IS_LARGE, 2, true, JSEXN_TYPEERR, "{0}{1} can't be an ArrayBuffer or an ArrayBufferView larger than 2 GB")
 MSG_DEF(MSG_TYPEDARRAY_IS_RESIZABLE, 2, true, JSEXN_TYPEERR, "{0}{1} can't be a resizable ArrayBuffer or ArrayBufferView")
+MSG_DEF(MSG_TYPEDARRAY_IS_IMMUTABLE, 2, true, JSEXN_TYPEERR, "{0}{1} can't be an immutable ArrayBuffer or ArrayBufferView")
 MSG_DEF(MSG_CACHE_ADD_FAILED_RESPONSE, 4, true, JSEXN_TYPEERR, "{0}Cache got {1} response with bad status {2} while trying to add request {3}")
 MSG_DEF(MSG_SW_UPDATE_BAD_REGISTRATION, 3, true, JSEXN_TYPEERR, "{0}Failed to update the ServiceWorker for scope {1} because the registration has been {2} since the update was scheduled.")
 MSG_DEF(MSG_INVALID_DURATION_ERROR, 2, true, JSEXN_TYPEERR, "{0}Invalid duration '{1}'.")

dom/bindings/TypedArray.h

@@ -711,6 +711,9 @@ struct TypedArray_base : public SpiderMonkeyInterfaceObjectStorage,
     MOZ_RELEASE_ASSERT(
         !ArrayT::fromObject(mImplObj).isResizable(),
         "Bindings must have checked ArrayBuffer{View} is non-resizable");
+    MOZ_RELEASE_ASSERT(
+        !ArrayT::fromObject(mImplObj).isImmutable(),
+        "Bindings must have checked ArrayBuffer{View} is mutable");
 
     // Intentionally return a pointer and length that escape from a nogc region.
     // Private so it can only be used in very limited situations.

dom/bindings/test/mochitest.toml

@@ -10,6 +10,7 @@ support-files = [
 ]
 prefs = [
   "javascript.options.large_arraybuffers=true",
+  "javascript.options.experimental.arraybuffer_immutable=true",
 ]
 
 ["test_ByteString.html"]
@@ -180,6 +181,12 @@ skip-if = [
   "!nightly_build", # Bug 1670026
 ]
 
+["test_immutable_arraybufferview.html"]
+skip-if = [
+  "!debug",
+  "!nightly_build", # Bug 1952253
+]
+
 ["test_returnUnion.html"]
 skip-if = ["!debug"]
 

dom/bindings/test/test_immutable_arraybufferview.html

@@ -0,0 +1,70 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1952253
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for immutable ArrayBufferViews</title>
+  <script src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1952253">Mozilla Bug 1952253</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+  <script type="application/javascript">
+    /* global TestFunctions */
+
+    function checkThrowsImmutable(f) {
+      let ex;
+      try{
+        f();
+        ok(false, "Should have thrown!");
+      } catch (e) {
+        ex = e;
+      }
+      ok(ex.toString().includes("immutable ArrayBuffer or ArrayBufferView"), "Got exception: " + ex);
+    }
+
+    add_task(async function test_immutable_arraybuffer_views() {
+      await SpecialPowers.pushPrefEnv({set: [["dom.expose_test_interfaces", true]]});
+      let test = new TestFunctions();
+
+      let ab = new ArrayBuffer(16).transferToImmutable();
+      checkThrowsImmutable(() => test.testNotAllowShared(ab));
+      checkThrowsImmutable(() => test.testAllowShared(ab));
+      checkThrowsImmutable(() => test.testDictWithAllowShared({arrayBuffer: ab}));
+      checkThrowsImmutable(() => test.testUnionOfBufferSource(ab));
+      checkThrowsImmutable(() => { test.arrayBuffer = ab; });
+      checkThrowsImmutable(() => { test.allowSharedArrayBuffer = ab; });
+      checkThrowsImmutable(() => { test.sequenceOfArrayBuffer = [ab]; });
+      checkThrowsImmutable(() => { test.sequenceOfAllowSharedArrayBuffer = [ab]; });
+
+      let ta = new Int8Array(ab);
+      checkThrowsImmutable(() => test.testNotAllowShared(ta));
+      checkThrowsImmutable(() => test.testAllowShared(ta));
+      checkThrowsImmutable(() => test.testDictWithAllowShared({arrayBufferView: ta}));
+      checkThrowsImmutable(() => test.testUnionOfBufferSource(ta));
+      checkThrowsImmutable(() => { test.arrayBufferView = ta; });
+      checkThrowsImmutable(() => { test.allowSharedArrayBufferView = ta; });
+      checkThrowsImmutable(() => { test.sequenceOfArrayBufferView = [ta]; });
+      checkThrowsImmutable(() => { test.sequenceOfAllowSharedArrayBufferView = [ta]; });
+
+      let dv = new DataView(ab);
+      checkThrowsImmutable(() => test.testNotAllowShared(dv));
+      checkThrowsImmutable(() => test.testAllowShared(dv));
+      checkThrowsImmutable(() => test.testDictWithAllowShared({arrayBufferView: dv}));
+      checkThrowsImmutable(() => test.testUnionOfBufferSource(dv));
+      checkThrowsImmutable(() => { test.arrayBufferView = dv; });
+      checkThrowsImmutable(() => { test.allowSharedArrayBufferView = dv; });
+      checkThrowsImmutable(() => { test.sequenceOfArrayBufferView = [dv]; });
+      checkThrowsImmutable(() => { test.sequenceOfAllowSharedArrayBufferView = [dv]; });
+    });
+  </script>
+</body>
+</html>