[JSC] Disable ArrayBuffer#transfer

https://bugs.webkit.org/show_bug.cgi?id=248484
rdar://102775650

Reviewed by Mark Lam.

ArrayBuffer#transfer's semantics is still under discussion, and TC39 decided separating this out from
the rest of resizable ArrayBuffer, and creating a new proposal for ArrayBuffer#transfer.
We disable ArrayBuffer#transfer to follow to this.

[1]: https://github.com/tc39/proposal-resizablearraybuffer/issues/113

* JSTests/ChakraCore/test/typedarray/arraybufferType.baseline-jsc:
* JSTests/stress/v8-harmony-arraybuffer-transfer.js:
* JSTests/test262/config.yaml:
* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:
(JSC::JSArrayBufferPrototype::finishCreation):
* Source/JavaScriptCore/runtime/OptionsList.h:

Canonical link: https://commits.webkit.org/257162@main

JSTests/ChakraCore/test/typedarray/arraybufferType.baseline-jsc

@@ -9,7 +9,6 @@ bar = 42
 slice
 byteLength
 resize
-transfer
 resizable
 maxByteLength
 constructor
@@ -24,7 +23,6 @@ bar = 42
 slice
 byteLength
 resize
-transfer
 resizable
 maxByteLength
 constructor

JSTests/stress/v8-harmony-arraybuffer-transfer.js

@@ -1,4 +1,4 @@
-//@ requireOptions("--useResizableArrayBuffer=1")
+//@ requireOptions("--useResizableArrayBuffer=1", "--useArrayBufferTransfer=1")
 // Copyright 2022 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

JSTests/test262/config.yaml

@@ -8,7 +8,7 @@ flags:
   ShadowRealm: useShadowRealm
   import-assertions: useImportAssertion
   json-modules: useImportAssertion
-  resizable-arraybuffer: useResizableArrayBuffer
+  resizable-arraybuffer: useArrayBufferTransfer
 skip:
   features:
     # https://bugs.webkit.org/show_bug.cgi?id=174931

Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp

@@ -461,7 +461,8 @@ void JSArrayBufferPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject
         JSC_NATIVE_GETTER_WITHOUT_TRANSITION(vm.propertyNames->byteLength, arrayBufferProtoGetterFuncByteLength, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
         if (Options::useResizableArrayBuffer()) {
             JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->resize, arrayBufferProtoFuncResize, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, ImplementationVisibility::Public);
-            JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->transfer, arrayBufferProtoFuncTransfer, static_cast<unsigned>(PropertyAttribute::DontEnum), 0, ImplementationVisibility::Public);
+            if (Options::useArrayBufferTransfer())
+                JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->transfer, arrayBufferProtoFuncTransfer, static_cast<unsigned>(PropertyAttribute::DontEnum), 0, ImplementationVisibility::Public);
             JSC_NATIVE_GETTER_WITHOUT_TRANSITION(vm.propertyNames->resizable, arrayBufferProtoGetterFuncResizable, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
             JSC_NATIVE_GETTER_WITHOUT_TRANSITION(vm.propertyNames->maxByteLength, arrayBufferProtoGetterFuncMaxByteLength, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
         }

Source/JavaScriptCore/runtime/OptionsList.h

@@ -544,6 +544,7 @@ bool canUseWebAssemblyFastMemory();
     \
     /* Feature Flags */\
     \
+    v(Bool, useArrayBufferTransfer, false, Normal, "Expose ArrayBuffer.transfer feature.") \
     v(Bool, useArrayGroupMethod, true, Normal, "Expose the group() and groupToMap() methods on Array.") \
     v(Bool, useAtomicsWaitAsync, true, Normal, "Expose the waitAsync() methods on Atomics.") \
     v(Bool, useImportAssertion, true, Normal, "Enable import assertion.") \