JSTypedArray: annotate swjs_create_typed_array for bounds-safety

Sources/JavaScriptKit/BasicObjects/JSTypedArray.swift

@@ -68,7 +68,12 @@ public final class JSTypedArray<Traits>: JSBridgedClass, ExpressibleByArrayLiter
     private static func createTypedArray(from buffer: UnsafeBufferPointer<Element>) -> JSObject {
         // Retain the constructor function to avoid it being released before calling `swjs_create_typed_array`
         let jsArrayRef = withExtendedLifetime(Self.constructor!) { ctor in
-            swjs_create_typed_array(ctor.id, buffer.baseAddress, Int32(buffer.count))
+            swjs_create_typed_array(
+                ctor.id,
+                buffer.baseAddress,
+                Int32(buffer.count),
+                Int32(MemoryLayout<Element>.stride)
+            )
         }
         return JSObject(id: jsArrayRef)
     }

Sources/_CJavaScriptKit/include/_CJavaScriptKit.h

@@ -8,6 +8,8 @@
 #endif
 #include <stdbool.h>
 #include <stdint.h>
+#include <ptrcheck.h>
+#include <lifetimebound.h>
 
 /// `JavaScriptObjectRef` represents JavaScript object reference that is referenced by Swift side.
 /// This value is an address of `SwiftRuntimeHeap`.
@@ -291,12 +293,21 @@ IMPORT_JS_FUNCTION(swjs_create_oneshot_function, JavaScriptObjectRef, (const Jav
 /// This is used to provide an efficient way to create `TypedArray`.
 ///
 /// @param constructor The `TypedArray` constructor.
-/// @param elements_ptr The elements pointer to initialize. They are assumed to be the same size of `constructor` elements size.
-/// @param length The length of `elements_ptr`
+/// @param elements_ptr The elements to copy into the new typed array. May be NULL
+///                     when `length` is 0 (Swift's `Array.baseAddress` is NULL for
+///                     empty arrays). The pointee bytes are copied; the pointer
+///                     does not escape the call.
+/// @param length The number of elements at `elements_ptr`.
+/// @param element_size The size in bytes of each element. Should match the byte
+///                     width of `constructor`'s element type
+///                     (`constructor.BYTES_PER_ELEMENT`). The JS side ignores this
+///                     value; it exists so clang's bounds-safety analyzer can
+///                     express the buffer size as `length * element_size`.
 /// @returns A reference to the constructed typed array
 IMPORT_JS_FUNCTION(swjs_create_typed_array, JavaScriptObjectRef, (const JavaScriptObjectRef constructor,
-                                                                  const void * _Nullable elements_ptr,
-                                                                  const int length))
+                                                                  const void * _Nullable __sized_by_or_null(length * element_size) __noescape elements_ptr,
+                                                                  const int length,
+                                                                  const int element_size))
 
 /// Copies the byte contents of a typed array into a Swift side memory buffer.
 ///