Bug 1452571 - Baldr: fix IsBufferSource on DataView and prevent shell-only rooting bug (r=anba)

js/src/shell/js.cpp

@@ -5810,13 +5810,6 @@ EnsureLatin1CharsLinearString(JSContext* cx, HandleValue value, JS::MutableHandl
 static bool
 ConsumeBufferSource(JSContext* cx, JS::HandleObject obj, JS::MimeType, JS::StreamConsumer* consumer)
 {
-    SharedMem<uint8_t*> dataPointer;
-    size_t byteLength;
-    if (!IsBufferSource(obj, &dataPointer, &byteLength)) {
-        JS_ReportErrorASCII(cx, "shell streaming consumes a buffer source (buffer or view)");
-        return false;
-    }
-
     {
         RootedValue url(cx);
         if (!JS_GetProperty(cx, obj, "url", &url))
@@ -5841,6 +5834,13 @@ ConsumeBufferSource(JSContext* cx, JS::HandleObject obj, JS::MimeType, JS::Strea
                                    : nullptr);
     }
 
+    SharedMem<uint8_t*> dataPointer;
+    size_t byteLength;
+    if (!IsBufferSource(obj, &dataPointer, &byteLength)) {
+        JS_ReportErrorASCII(cx, "shell streaming consumes a buffer source (buffer or view)");
+        return false;
+    }
+
     auto job = cx->make_unique<BufferStreamJob>(consumer);
     if (!job || !job->bytes.resize(byteLength))
         return false;

js/src/vm/TypedArrayObject.cpp

@@ -2140,6 +2140,7 @@ js::IsBufferSource(JSObject* object, SharedMem<uint8_t*>* dataPointer, size_t* b
         DataViewObject& view = object->as<DataViewObject>();
         *dataPointer = view.dataPointerEither().cast<uint8_t*>();
         *byteLength = view.byteLength();
+        return true;
     }
 
     if (object->is<ArrayBufferObject>()) {