postMessage(): transfer allocation costs along with value.

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h

 /*
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 110 matching lines @@
   static std::unique_ptr<ArrayBufferContentsArray> transferArrayBufferContents(
       v8::Isolate*,
       const ArrayBufferArray&,
       ExceptionState&);
 
   static std::unique_ptr<ImageBitmapContentsArray> transferImageBitmapContents(
       v8::Isolate*,
       const ImageBitmapArray&,
       ExceptionState&);
 
-  // Informs the V8 about external memory allocated and owned by this object.
+  // Informs V8 about external memory allocated and owned by this object.
   // Large values should contribute to GC counters to eventually trigger a GC,
   // otherwise flood of postMessage() can cause OOM.
   // Ok to invoke multiple times (only adds memory once).
   // The memory registration is revoked automatically in destructor.
   void registerMemoryAllocatedWithCurrentScriptContext();
 
+  // Upon passing a serialized value from one context to another (via a
+  // postMessage()), the allocation amounts it has registered with the
+  // 'origining' context must be discharged, as the 'target' context will assume
+  // ownership of value. This method takes care of the first part of the
+  // external allocation bookkeeping, the above registration method the other
+  // half.
+  void unregisterMemoryAllocatedByCurrentScriptContext();
+
   const uint8_t* data() const { return m_dataBuffer.get(); }
   size_t dataLengthInBytes() const { return m_dataBufferSize; }
 
   BlobDataHandleMap& blobDataHandles() { return m_blobDataHandles; }
   ArrayBufferContentsArray* getArrayBufferContentsArray() {
     return m_arrayBufferContentsArray.get();
   }
   ImageBitmapContentsArray* getImageBitmapContentsArray() {
     return m_imageBitmapContentsArray.get();
   }
@@ skipping 24 matching lines @@
   void transferOffscreenCanvas(v8::Isolate*,
                                const OffscreenCanvasArray&,
                                ExceptionState&);
 
   DataBufferPtr m_dataBuffer;
   size_t m_dataBufferSize = 0;
 
   std::unique_ptr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
   std::unique_ptr<ImageBitmapContentsArray> m_imageBitmapContentsArray;
   BlobDataHandleMap m_blobDataHandles;
-  intptr_t m_externallyAllocatedMemory;
+  size_t m_externallyAllocatedMemory;
+  bool m_adjustTransferableExternalAllocationOnContextTransfer;
 };
 
 }  // namespace blink
 
 #endif  // SerializedScriptValue_h