Store Arraybuffer Metadata in its own Arena
The bug tracks backporting and landing https://bugzilla.mozilla.org/show_bug.cgi?id=1474659 to move ArrayBuffer metadata (including length) into its own jemalloc arena. This will hopefully make it harder to write exploits that fiddle the length of ArrayBuffers.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information