[scriptserializer] (de)serialize the ByteLength field of DOMArrayBuffer

The ByteLength field of DOMArrayBuffer changed to size_t. Therefore
we have to serialize it as Uint64 now.

Bug: v8:4153
Change-Id: I38642b5261f9d64a6307cc609e9ba61a4f35860c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1912201Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#714935}

third_party/blink/renderer/bindings/core/v8/serialization/serialization_tag.h

@@ -59,7 +59,7 @@ enum SerializationTag {
       'L',  // length:uint32_t, files:int32_t[length] -> FileList (ref)
   kImageDataTag = '#',    // tags terminated by ImageSerializationTag::kEnd (see
                           // SerializedColorParams.h), width:uint32_t,
-                          // height:uint32_t, pixelDataLength:uint32_t,
+                          // height:uint32_t, pixelDataLength:uint64_t,
                           // data:byte[pixelDataLength]
                           // -> ImageData (ref)
   kImageBitmapTag = 'g',  // tags terminated by ImageSerializationTag::kEnd (see

third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_deserializer.cc

@@ -365,7 +365,7 @@ ScriptWrappable* V8ScriptValueDeserializer::ReadDOMObject(
       SerializedColorSpace canvas_color_space = SerializedColorSpace::kSRGB;
       SerializedImageDataStorageFormat image_data_storage_format =
           SerializedImageDataStorageFormat::kUint8Clamped;
-      uint32_t width = 0, height = 0, byte_length = 0;
+      uint32_t width = 0, height = 0;
       const void* pixels = nullptr;
       if (Version() >= 18) {
         bool is_done = false;
@@ -395,14 +395,21 @@ ScriptWrappable* V8ScriptValueDeserializer::ReadDOMObject(
           }
         } while (!is_done);
       }
+
+      uint64_t byte_length_64 = 0;
+      size_t byte_length = 0;
       if (!ReadUint32(&width) || !ReadUint32(&height) ||
-          !ReadUint32(&byte_length) || !ReadRawBytes(byte_length, &pixels))
+          !ReadUint64(&byte_length_64) ||
+          !base::MakeCheckedNum(byte_length_64).AssignIfValid(&byte_length) ||
+          !ReadRawBytes(byte_length, &pixels)) {
         return nullptr;
+      }
+
       SerializedColorParams color_params(
           canvas_color_space, SerializedPixelFormat::kRGBA8,
           SerializedOpacityMode::kNonOpaque, image_data_storage_format);
       ImageDataStorageFormat storage_format = color_params.GetStorageFormat();
-      base::CheckedNumeric<uint32_t> computed_byte_length = width;
+      base::CheckedNumeric<size_t> computed_byte_length = width;
       computed_byte_length *= height;
       computed_byte_length *= 4;
       computed_byte_length *= ImageData::StorageFormatDataSize(storage_format);
@@ -414,7 +421,7 @@ ScriptWrappable* V8ScriptValueDeserializer::ReadDOMObject(
       if (!image_data)
         return nullptr;
       DOMArrayBufferBase* pixel_buffer = image_data->BufferBase();
-      DCHECK_EQ(pixel_buffer->DeprecatedByteLengthAsUnsigned(), byte_length);
+      DCHECK_EQ(pixel_buffer->ByteLengthAsSizeT(), byte_length);
       memcpy(pixel_buffer->Data(), pixels, byte_length);
       return image_data;
     }

third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer.cc

@@ -330,9 +330,8 @@ bool V8ScriptValueSerializer::WriteDOMObject(ScriptWrappable* wrappable,
     WriteUint32(image_data->width());
     WriteUint32(image_data->height());
     DOMArrayBufferBase* pixel_buffer = image_data->BufferBase();
-    uint32_t pixel_buffer_length =
-        pixel_buffer->DeprecatedByteLengthAsUnsigned();
-    WriteUint32(pixel_buffer_length);
+    size_t pixel_buffer_length = pixel_buffer->ByteLengthAsSizeT();
+    WriteUint64(base::strict_cast<uint64_t>(pixel_buffer_length));
     WriteRawBytes(pixel_buffer->Data(), pixel_buffer_length);
     return true;
   }