Remove refcount thrash in ReplaceUnmatchedSurrogates().

This CL is broken out of
https://chromium-review.googlesource.com/c/chromium/src/+/1557854

Bug: 1083392
Change-Id: I58e449d5aa856a32fc24348f4bf5ccd34e5bc685
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2296820
Commit-Queue: Jeremy Roman <jbroman@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Auto-Submit: Albert J. Wong <ajwong@chromium.org>
Cr-Commit-Position: refs/heads/master@{#788591}

third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.cc

@@ -551,7 +551,7 @@ static bool HasUnmatchedSurrogates(const String& string) {
 }
 
 // Replace unmatched surrogates with REPLACEMENT CHARACTER U+FFFD.
-String ReplaceUnmatchedSurrogates(const String& string) {
+String ReplaceUnmatchedSurrogates(String string) {
   // This roughly implements http://heycam.github.io/webidl/#dfn-obtain-unicode
   // but since Blink strings are 16-bits internally, the output is simply
   // re-encoded to UTF-16.
@@ -574,8 +574,8 @@ String ReplaceUnmatchedSurrogates(const String& string) {
   unsigned i = 0;
 
   // 4. Initialize U to be an empty sequence of Unicode characters.
-  StringBuilder u;
-  u.ReserveCapacity(n);
+  StringBuffer<UChar> result(n);
+  UChar* u = result.Characters();
 
   // 5. While i < n:
   while (i < n) {
@@ -585,17 +585,17 @@ String ReplaceUnmatchedSurrogates(const String& string) {
     if (U16_IS_SINGLE(c)) {
       // c < 0xD800 or c > 0xDFFF
       // Append to U the Unicode character with code point c.
-      u.Append(c);
+      u[i] = c;
     } else if (U16_IS_TRAIL(c)) {
       // 0xDC00 <= c <= 0xDFFF
       // Append to U a U+FFFD REPLACEMENT CHARACTER.
-      u.Append(kReplacementCharacter);
+      u[i] = kReplacementCharacter;
     } else {
       // 0xD800 <= c <= 0xDBFF
       DCHECK(U16_IS_LEAD(c));
       if (i == n - 1) {
         // 1. If i = n-1, then append to U a U+FFFD REPLACEMENT CHARACTER.
-        u.Append(kReplacementCharacter);
+        u[i] = kReplacementCharacter;
       } else {
         // 2. Otherwise, i < n-1:
         DCHECK_LT(i, n - 1);
@@ -607,13 +607,12 @@ String ReplaceUnmatchedSurrogates(const String& string) {
           // ..2. Let b be d & 0x3FF.
           // ..3. Append to U the Unicode character with code point
           //      2^16+2^10*a+b.
-          u.Append(U16_GET_SUPPLEMENTARY(c, d));
-          // Blink: This is equivalent to u.append(c); u.append(d);
-          ++i;
+          u[i++] = c;
+          u[i] = d;
         } else {
           // 3. Otherwise, d < 0xDC00 or d > 0xDFFF. Append to U a U+FFFD
           //    REPLACEMENT CHARACTER.
-          u.Append(kReplacementCharacter);
+          u[i] = kReplacementCharacter;
         }
       }
     }
@@ -622,8 +621,8 @@ String ReplaceUnmatchedSurrogates(const String& string) {
   }
 
   // 6. Return U.
-  DCHECK_EQ(u.length(), string.length());
-  return u.ToString();
+  DCHECK_EQ(i, string.length());
+  return String::Adopt(result);
 }
 
 XPathNSResolver* ToXPathNSResolver(ScriptState* script_state,

third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h

@@ -325,7 +325,7 @@ inline base::Optional<base::Time> ToCoreNullableDate(
 }
 
 // USVString conversion helper.
-CORE_EXPORT String ReplaceUnmatchedSurrogates(const String&);
+CORE_EXPORT String ReplaceUnmatchedSurrogates(String);
 
 // FIXME: Remove the special casing for XPathNSResolver.
 XPathNSResolver* ToXPathNSResolver(ScriptState*, v8::Local<v8::Value>);