feat(ses): shim ArrayBuffer.prototype.transfer

[erights]

Staged on #2419

Closes: #XXXX
Refs: #2414 #2418 #2419

Description

#2414 by itself does not work on Node 18 and Node 20 because

• those platforms do not have Array.prototype.transfer, so feat(pass-style,marshal): ByteArray, a binary Passable #2414 must use structuredClone instead
• structuredClone does exist on Node >= 18, so it should be on supported platforms (though see The ses-shim tests on Node 12 despite our min support being Node 18 #2418 ). However, structuredClone itself is dangerous and so must not be added to the shared intrinsics. As a result, in feat(pass-style,marshal): ByteArray, a binary Passable #2414 , when @endo/pass-style is initialized in a created compartment, it fails to find either Array.prototype.transfer and `structuredClone

To solve this, @kriskowal suggested that we also shim Array.prototype.transfer if needed during lockdown, along with other repairs. We are avoiding similarly shimming Array.prototype.transferToImmutable because it is not yet standard. But Array.prototype.transfer is standard, and so lockdown can globally shim it before hardening the shared intrinsics.

This PR implements @kriskowal 's suggestion.

Security Considerations

none

Scaling Considerations

by itself, none

Documentation Considerations

nothing signicant.

Testing Considerations

See #2418 . Aside from that, none

Compatibility and Upgrade Considerations

On platforms with neither Array.prototype.transfer nor a global structuredClone, the ses-shim will currently not install an emulation of Array.prototype.transfer. However, once we verify that endo is not intended to support platforms without both, we may change lockdown to throw, failing to lock down.

[erights]

See #2418

The platform-compatability-test tests are not marked as required, so solving #2418 does not actually block this PR. But it would be nice to get that fixed first.

[mhofman]

Please consider removing the unnecessary slice call as brand check, and improve support for when the new length doesn't match.

[erights]

PTAL

[erights]

Please consider removing the unnecessary slice call as brand check, and improve support for when the new length doesn't match.

Done

[mhofman]

Thanks for addressing the previous feedback. There is indeed a better way to copy an array buffer,