There are two flavours of the mozjs `TypedArray<T>` wrapper for typed
array objects: one stores a `Box<Heap<*mut JSObject>>`, while the other
just has a bare `*mut JSObject`. The second one must only be stored
inside the `CustomAutoRoot` rooting values, but we were using it in many
other places like WebIDL dictionaries without rooting it safely. These
changes make our typed array APIs always use
`RootedTraceableBox<TypedArray<T>>` with the `Box<Heap<*mut JSObject>>`
flavour, which ensures that the JS object stored inside the typed array
wrapper is always visible to the SpiderMonkey GC.
Testing: Adds a new test that crashes without these changes.
Fixes: #41206
---------
Signed-off-by: Josh Matthews <josh@joshmatthews.net>
d86d2a90aa