Bug 1002864 - Ignore the change-data/same-data argument to neuter() and JS_NeuterArrayBuffer when the buffer being neutered doesn't support the given data disposition. r=sfink

js/src/jit-test/tests/asm.js/testNeuter.js

@@ -26,6 +26,7 @@ if (isAsmJSCompilationAvailable())
 set(4, 42);
 assertEq(get(4), 42);
 
+neuter(buffer, "change-data");
 neuter(buffer, "same-data");
 
 // These operations may throw internal errors
@@ -61,6 +62,12 @@ function ffi() {
         assertEq(String(e).indexOf("InternalError"), 0);
         threw = true;
     }
+    try {
+        neuter(buffer, "change-data");
+    } catch (e) {
+        assertEq(String(e).indexOf("InternalError"), 0);
+        threw = true;
+    }
 }
 var inner = f2(this, {ffi:ffi}, buffer);
 if (isAsmJSCompilationAvailable())

js/src/jsfriendapi.h

@@ -1453,6 +1453,12 @@ typedef enum {
 
 /*
  * Set an ArrayBuffer's length to 0 and neuter all of its views.
+ *
+ * The |changeData| argument is a hint to inform internal behavior with respect
+ * to the internal pointer to the ArrayBuffer's data after being neutered.
+ * There is no guarantee it will be respected.  But if it is respected, the
+ * ArrayBuffer's internal data pointer will, or will not, have changed
+ * accordingly.
  */
 extern JS_FRIEND_API(bool)
 JS_NeuterArrayBuffer(JSContext *cx, JS::HandleObject obj,

js/src/vm/ArrayBufferObject.cpp

@@ -1030,7 +1030,7 @@ JS_NeuterArrayBuffer(JSContext *cx, HandleObject obj,
     }
 
     void *newData;
-    if (changeData == ChangeData) {
+    if (changeData == ChangeData && buffer->hasStealableContents()) {
         newData = AllocateArrayBufferContents(cx, buffer->byteLength());
         if (!newData)
             return false;