V8ScriptValueSerializer: Use PartitionAlloc for the buffer, and avoid copying it into a String.

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h

Index: third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h b/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h
index c5195878da23933cccdf4aef4282d0eb69b8c315..f4a4e18cd33061aab9d7f768e708b41753b58085 100644
--- a/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h
+++ b/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h
@@ -36,6 +36,7 @@
 #include "core/CoreExport.h"
 #include "wtf/HashMap.h"
 #include "wtf/ThreadSafeRefCounted.h"
+#include "wtf/allocator/Partitions.h"
 #include "wtf/typed_arrays/ArrayBufferContents.h"
 #include <memory>
 #include <v8.h>
@@ -92,7 +93,7 @@ class CORE_EXPORT SerializedScriptValue
 
   static PassRefPtr<SerializedScriptValue> nullValue();
 
-  String toWireString() const { return m_data; }
+  String toWireString() const;
   void toWireBytes(Vector<char>&) const;
 
   // Deserializes the value (in the current context). Returns a null value in
@@ -129,7 +130,27 @@ class CORE_EXPORT SerializedScriptValue
   // The memory registration is revoked automatically in destructor.
   void registerMemoryAllocatedWithCurrentScriptContext();
 
-  String& data() { return m_data; }
+  // Provides access to the data and its attributes, regardless of whether the
+  // data was created as a string or as a vector.
+  // TODO(jbroman): Remove the 16-bit string representation, and simplify.
+  const uint8_t* data() {
+    if (!m_data.isNull()) {
+      m_data.ensure16Bit();

[haraken, 2016/11/11 03:50:01]

Shall we rename m_data to m_dataString?

[jbroman, 2016/11/11 16:14:58]

Done.

+      return reinterpret_cast<const uint8_t*>(m_data.characters16());
+    }
+    return m_dataBuffer.get();
+  }
+  size_t dataLengthInBytes() const {
+    if (!m_data.isNull())
+      return m_data.length() * 2;
+    return m_dataBufferSize;
+  }
+  bool dataHasOneRef() const {
+    if (!m_data.isNull())
+      return m_data.impl()->hasOneRef();
+    return true;
+  }
+
   BlobDataHandleMap& blobDataHandles() { return m_blobDataHandles; }
   ArrayBufferContentsArray* getArrayBufferContentsArray() {
     return m_arrayBufferContentsArray.get();
@@ -142,12 +163,25 @@ class CORE_EXPORT SerializedScriptValue
   friend class ScriptValueSerializer;
   friend class V8ScriptValueSerializer;
 
-  enum StringDataMode { StringValue, WireData };
+  struct BufferDeleter {
+    void operator()(uint8_t* buffer) { WTF::Partitions::bufferFree(buffer); }
+  };
+  using DataBufferPtr = std::unique_ptr<uint8_t[], BufferDeleter>;
 
   SerializedScriptValue();
   explicit SerializedScriptValue(const String& wireData);
 
-  void setData(const String& data) { m_data = data; }
+  void setData(const String& data) {
+    m_data = data;
+    m_dataBuffer.reset();
+    m_dataBufferSize = 0;
+  }
+  void setData(DataBufferPtr data, size_t size) {
+    m_data = String();
+    m_dataBuffer = std::move(data);
+    m_dataBufferSize = size;
+  }
+
   void transferArrayBuffers(v8::Isolate*,
                             const ArrayBufferArray&,
                             ExceptionState&);
@@ -158,7 +192,14 @@ class CORE_EXPORT SerializedScriptValue
                                const OffscreenCanvasArray&,
                                ExceptionState&);
 
+  // Either |m_data| is set (if the serialized data is stored in a WTF::String),
+  // or |m_dataBuffer| is (if it is stored in a raw buffer allocation). In the

[haraken, 2016/11/11 03:50:01]

Can we add a DCHECK to verify that |m_data| and |m_dataBuffer| are not used at
the same time?

[jbroman, 2016/11/11 16:14:58]

I've added one to the data() getter; I'm not sure where else you would like one.

+  // latter case, the size is stored separately, and will not necessarily be
+  // even in length.

[haraken, 2016/11/11 03:50:01]

What do you mean by "will not necessarily be even in length"? If the data is
stored in m_dataBuffer, m_data.length() should be 0.

[jbroman, 2016/11/11 16:14:58]

I mean that while the string version will always be a multiple of two bytes in
length (due to being backed by a 16-bit string), the raw buffer version may not
be. I've reworded the comment; let me know if it's clearer.

   String m_data;
+  DataBufferPtr m_dataBuffer;
+  size_t m_dataBufferSize;
+
   std::unique_ptr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
   std::unique_ptr<ImageBitmapContentsArray> m_imageBitmapContentsArray;
   BlobDataHandleMap m_blobDataHandles;