Add malloc_create_partition and {m,re}alloc_from_partition to mozmemory's API.
Copy sandbox option strings instead of adopting them.

Strings coming from JS objects are allocated on a separate heap,
but nsCString is unaware of that, and tries to free its underlying
buffer using a regular free(); because of that, we need to copy the
string into a separate buffer allocated from the correct heap.
Use js_free in ThreadSharedFloatArrayBufferList.

This may be wrong, as the underlying buffer seems to be entirely internal
and not exposed to content (in fact, it is immutable). Perhaps the proper
solution to this would be to copy the buffer in

StealJSArrayDataIntoThreadSharedFloatArrayBufferList

in AudioBuffer.cpp
Use a separate partition for all SpiderMonkey allocations.
Add MOZ_JEMALLOC3 to mozconfig.