V8ScriptValueSerializer: Use PartitionAlloc for the buffer, and avoid copying it into a String.

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h

 /*
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 18 matching lines @@
  */
 
 #ifndef SerializedScriptValue_h
 #define SerializedScriptValue_h
 
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/Transferables.h"
 #include "core/CoreExport.h"
 #include "wtf/HashMap.h"
 #include "wtf/ThreadSafeRefCounted.h"
+#include "wtf/allocator/Partitions.h"
 #include "wtf/typed_arrays/ArrayBufferContents.h"
 #include <memory>
 #include <v8.h>
 
 namespace blink {
 
 class BlobDataHandle;
 class Transferables;
 class ExceptionState;
 class StaticBitmapImage;
@@ skipping 36 matching lines @@
 
   static PassRefPtr<SerializedScriptValue> create();
   static PassRefPtr<SerializedScriptValue> create(const String&);
   static PassRefPtr<SerializedScriptValue> create(const char* data,
                                                   size_t length);
 
   virtual ~SerializedScriptValue();
 
   static PassRefPtr<SerializedScriptValue> nullValue();
 
-  String toWireString() const { return m_data; }
+  String toWireString() const;
   void toWireBytes(Vector<char>&) const;
 
   // Deserializes the value (in the current context). Returns a null value in
   // case of failure.
   v8::Local<v8::Value> deserialize(MessagePortArray* = 0);
   v8::Local<v8::Value> deserialize(v8::Isolate*,
                                    MessagePortArray* = 0,
                                    const WebBlobInfoArray* = 0);
 
   // Helper function which pulls the values out of a JS sequence and into a
@@ skipping 16 matching lines @@
       const ArrayBufferArray&,
       ExceptionState&);
 
   // Informs the V8 about external memory allocated and owned by this object.
   // Large values should contribute to GC counters to eventually trigger a GC,
   // otherwise flood of postMessage() can cause OOM.
   // Ok to invoke multiple times (only adds memory once).
   // The memory registration is revoked automatically in destructor.
   void registerMemoryAllocatedWithCurrentScriptContext();
 
-  String& data() { return m_data; }
+  // Provides access to the data and its attributes, regardless of whether the
+  // data was created as a string or as a vector.
+  // TODO(jbroman): Remove the 16-bit string representation, and simplify.
+  const uint8_t* data() {
+    if (!m_data.isNull()) {
+      m_data.ensure16Bit();

[haraken, 2016/11/11 03:50:01]

Shall we rename m_data to m_dataString?

[jbroman, 2016/11/11 16:14:58]

Done.

+      return reinterpret_cast<const uint8_t*>(m_data.characters16());
+    }
+    return m_dataBuffer.get();
+  }
+  size_t dataLengthInBytes() const {
+    if (!m_data.isNull())
+      return m_data.length() * 2;
+    return m_dataBufferSize;
+  }
+  bool dataHasOneRef() const {
+    if (!m_data.isNull())
+      return m_data.impl()->hasOneRef();
+    return true;
+  }
+
   BlobDataHandleMap& blobDataHandles() { return m_blobDataHandles; }
   ArrayBufferContentsArray* getArrayBufferContentsArray() {
     return m_arrayBufferContentsArray.get();
   }
   ImageBitmapContentsArray* getImageBitmapContentsArray() {
     return m_imageBitmapContentsArray.get();
   }
 
  private:
   friend class ScriptValueSerializer;
   friend class V8ScriptValueSerializer;
 
-  enum StringDataMode { StringValue, WireData };
+  struct BufferDeleter {
+    void operator()(uint8_t* buffer) { WTF::Partitions::bufferFree(buffer); }
+  };
+  using DataBufferPtr = std::unique_ptr<uint8_t[], BufferDeleter>;
 
   SerializedScriptValue();
   explicit SerializedScriptValue(const String& wireData);
 
-  void setData(const String& data) { m_data = data; }
+  void setData(const String& data) {
+    m_data = data;
+    m_dataBuffer.reset();
+    m_dataBufferSize = 0;
+  }
+  void setData(DataBufferPtr data, size_t size) {
+    m_data = String();
+    m_dataBuffer = std::move(data);
+    m_dataBufferSize = size;
+  }
+
   void transferArrayBuffers(v8::Isolate*,
                             const ArrayBufferArray&,
                             ExceptionState&);
   void transferImageBitmaps(v8::Isolate*,
                             const ImageBitmapArray&,
                             ExceptionState&);
   void transferOffscreenCanvas(v8::Isolate*,
                                const OffscreenCanvasArray&,
                                ExceptionState&);
 
+  // Either |m_data| is set (if the serialized data is stored in a WTF::String),
+  // or |m_dataBuffer| is (if it is stored in a raw buffer allocation). In the

[haraken, 2016/11/11 03:50:01]

Can we add a DCHECK to verify that |m_data| and |m_dataBuffer| are not used at
the same time?

[jbroman, 2016/11/11 16:14:58]

I've added one to the data() getter; I'm not sure where else you would like one.

+  // latter case, the size is stored separately, and will not necessarily be
+  // even in length.

[haraken, 2016/11/11 03:50:01]

What do you mean by "will not necessarily be even in length"? If the data is
stored in m_dataBuffer, m_data.length() should be 0.

[jbroman, 2016/11/11 16:14:58]

I mean that while the string version will always be a multiple of two bytes in
length (due to being backed by a 16-bit string), the raw buffer version may not
be. I've reworded the comment; let me know if it's clearer.

   String m_data;
+  DataBufferPtr m_dataBuffer;
+  size_t m_dataBufferSize;
+
   std::unique_ptr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
   std::unique_ptr<ImageBitmapContentsArray> m_imageBitmapContentsArray;
   BlobDataHandleMap m_blobDataHandles;
   intptr_t m_externallyAllocatedMemory;
 };
 
 }  // namespace blink
 
 #endif  // SerializedScriptValue_h