fetch: avoid aliasing cloned body buffers

[EffortlessSteven]

Summary

Addresses #22885.

Cloned response bodies exposed shared backing storage through arrayBuffer() and bytes(). This copies shared stores before creating mutable JS buffers, keeping the zero-copy transfer path for uniquely owned stores.

Changes:

• copy shared Blob store bytes before exposing ArrayBuffer/Uint8Array views
• add Response clone aliasing regressions for arrayBuffer() and bytes()

Credits

Thanks to @ChALkeR for the spec analysis and reproduction.

Verification

• cargo fmt --all --check
• git diff --check -- src/runtime/webcore/Blob.rs test/js/web/fetch/body-clone.test.ts
• bun bd -e "console.log('ok')"
• bun bd test test/js/web/fetch/body-clone.test.ts -t "22885"
• Regression confirmed: unpatched mutates the original response body; patched preserves the original bytes

Review map

• Blob.rs: shared-store guard in the Lifetime::Transfer path before take_store()
• body-clone.test.ts: Response clone regressions for arrayBuffer(), bytes(), sibling clone isolation, and sole-owner fast path

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 344e836c-e4fe-45de-b312-bcb5ce935b7b

📥 Commits

Reviewing files that changed from the base of the PR and between 7069b30 and 846db95.

📒 Files selected for processing (2)

• src/runtime/webcore/Blob.rs
• test/js/web/fetch/body-clone.test.ts

---

Walkthrough

This PR fixes a memory aliasing bug in blob data transfer by conditionally copying shared backing stores during Lifetime::Transfer operations, and adds regression tests to prevent Response.clone() from mutating the original body through a shared buffer reference.

Changes

Response body aliasing safety

Layer / File(s)	Summary
Blob transfer safety check src/runtime/webcore/Blob.rs	When transferring blob data with Lifetime::Transfer, the code now checks if the backing store's refcount is unique; if shared, it creates a copied ArrayBuffer instead of transferring the store ref directly, preventing mutations through aliased ownership.
Response clone mutation regression tests test/js/web/fetch/body-clone.test.ts	Four regression tests validate that Response.clone() with arrayBuffer() or bytes() read paths does not alias the original body, that sibling clones stay independent, and that the direct fast path still returns correct bytes.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically describes the main change: preventing aliasing bugs in cloned response body buffers.
Description check	✅ Passed	The PR description provides comprehensive detail including issue reference, problem explanation, code changes, verification steps, and review map, exceeding the minimal template requirements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[robobun]

Thanks for the fix and the tests. The same change landed on main in #33072 (merged July 4): Blob.rs now takes the copy path in the Lifetime::Transfer arm whenever the store has more than one ref, which is the same guard this PR adds, and #22885 was closed against it.

I checked this PR's four #22885 tests from test/js/web/fetch/body-clone.test.ts against current main (04148c8) and all four pass there, as does the no-network repro from the issue (mutating one clone's buffer no longer reaches the original or sibling clones). Main also carries equivalent coverage in test/js/web/fetch/blob-cow.test.ts.

Closing since there is nothing left for this PR to change. If you still see aliasing on a current canary (bun upgrade --canary), please open an issue with the repro and we will take another look.