As the comment says:

static inline void js_free(void* p) {
  // TODO: This should call |moz_arena_free(js::MallocArena, p)| but we
  // currently can't enforce that all memory freed here was allocated by
  // js_malloc().
  free(p);
}

An example of an allocation that would not be in this arena is ArrayBuffer data, which gets allocated into its own js::ArrayBufferContentsArena. Or at least, sometimes it does.

https://hg.mozilla.org/mozilla-central/rev/a1a954a12f34

Other than an assertion there's currently no reason to free memory in its own arena.

https://searchfox.org/mozilla-central/source/memory/build/mozjemalloc.cpp#3634

jemalloc will always find the correct arena based on the memory's location and then use that, the only time aArena is used is for the above assertion. But if we ever switch to a more pedantic allocator this could be relevant.

The leave-open keyword is there and there is no activity for 6 months.
:sfink, maybe it's time to close this bug?
For more information, please visit BugBot documentation.