BASELINE: Update Chromium to 100.0.4896.167

Change-Id: I98cbeb5d7543d966ffe04d8cefded0c493a11333
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

22 files changed, 158 insertions, 116 deletions

diff --git a/chromium/gin/BUILD.gn b/chromium/gin/BUILD.gn
index 93d501cfb63..dfd63983c35 100644
--- a/chromium/gin/BUILD.gn
+++ b/chromium/gin/BUILD.gn
@@ -175,7 +175,10 @@ test("gin_unittests") {
     "//v8:external_startup_data",
   ]
 
-  data_deps = [ "//tools/v8_context_snapshot:v8_context_snapshot" ]
+  data_deps = [
+    "//testing/buildbot/filters:gin_unittests_filters",
+    "//tools/v8_context_snapshot:v8_context_snapshot",
+  ]
   data = []
 
   # gin_shell is not an Android app.
@@ -192,6 +195,7 @@ test("gin_unittests") {
   }
 
   if (is_fuchsia) {
+    use_cfv2 = false
     additional_manifest_fragments = [
       # TODO(crbug.com/1185811): Figure out why jit_capabilities is needed.
       "//build/config/fuchsia/test/jit_capabilities.test-cmx",
diff --git a/chromium/gin/arguments.cc b/chromium/gin/arguments.cc
index 3a2ba9b160b..fadb1d2dca4 100644
--- a/chromium/gin/arguments.cc
+++ b/chromium/gin/arguments.cc
@@ -56,7 +56,7 @@ v8::Local<v8::Context> Arguments::GetHolderCreationContext() const {
   v8::Local<v8::Object> holder = is_for_property_
                                      ? info_for_property_->Holder()
                                      : info_for_function_->Holder();
-  return holder->CreationContext();
+  return holder->GetCreationContextChecked();
 }
 
 std::string V8TypeAsString(v8::Isolate* isolate, v8::Local<v8::Value> value) {
diff --git a/chromium/gin/array_buffer.cc b/chromium/gin/array_buffer.cc
index 769aa10920e..2e78aa60fc9 100644
--- a/chromium/gin/array_buffer.cc
+++ b/chromium/gin/array_buffer.cc
@@ -12,13 +12,13 @@
 #include "build/build_config.h"
 #include "gin/per_isolate_data.h"
 
-#if defined(OS_POSIX)
+#if BUILDFLAG(IS_POSIX)
 #include <sys/mman.h>
 
 #ifndef MAP_ANONYMOUS
 #define MAP_ANONYMOUS MAP_ANON
 #endif
-#endif  // defined(OS_POSIX)
+#endif  // BUILDFLAG(IS_POSIX)
 
 namespace gin {
 
diff --git a/chromium/gin/converter.cc b/chromium/gin/converter.cc
index f8695228a4d..12d12b873a6 100644
--- a/chromium/gin/converter.cc
+++ b/chromium/gin/converter.cc
@@ -7,6 +7,7 @@
 #include <stdint.h>
 
 #include "base/strings/string_util.h"
+#include "base/time/time.h"
 #include "v8/include/v8-array-buffer.h"
 #include "v8/include/v8-external.h"
 #include "v8/include/v8-function.h"
@@ -17,7 +18,6 @@
 #include "v8/include/v8-value.h"
 
 using v8::ArrayBuffer;
-using v8::Boolean;
 using v8::External;
 using v8::Function;
 using v8::Int32;
@@ -48,7 +48,7 @@ bool FromMaybe(Maybe<T> maybe, U* out) {
 namespace gin {
 
 Local<Value> Converter<bool>::ToV8(Isolate* isolate, bool val) {
-  return Boolean::New(isolate, val).As<Value>();
+  return v8::Boolean::New(isolate, val).As<Value>();
 }
 
 bool Converter<bool>::FromV8(Isolate* isolate, Local<Value> val, bool* out) {
@@ -182,6 +182,12 @@ bool Converter<std::u16string>::FromV8(Isolate* isolate,
   return true;
 }
 
+v8::Local<v8::Value> Converter<base::TimeTicks>::ToV8(v8::Isolate* isolate,
+                                                      base::TimeTicks val) {
+  return v8::BigInt::New(isolate, val.since_origin().InMicroseconds())
+      .As<v8::Value>();
+}
+
 Local<Value> Converter<Local<Function>>::ToV8(Isolate* isolate,
                                               Local<Function> val) {
   return val.As<Value>();
diff --git a/chromium/gin/converter.h b/chromium/gin/converter.h
index 3621dae8192..7a6392f9290 100644
--- a/chromium/gin/converter.h
+++ b/chromium/gin/converter.h
@@ -20,6 +20,10 @@
 #include "v8/include/v8-forward.h"
 #include "v8/include/v8-isolate.h"
 
+namespace base {
+class TimeTicks;
+}
+
 namespace gin {
 
 template<typename KeyType>
@@ -132,6 +136,14 @@ struct GIN_EXPORT Converter<std::u16string> {
                      std::u16string* out);
 };
 
+// Converter for C++ TimeTicks to Javascript BigInt (unit: microseconds).
+// TimeTicks can't be converted using the existing Converter<int64_t> because
+// the target type will be Number and will lose precision.
+template <>
+struct GIN_EXPORT Converter<base::TimeTicks> {
+  static v8::Local<v8::Value> ToV8(v8::Isolate* isolate, base::TimeTicks val);
+};
+
 template <>
 struct GIN_EXPORT Converter<v8::Local<v8::Function>> {
   static v8::Local<v8::Value> ToV8(v8::Isolate* isolate,
diff --git a/chromium/gin/debug_impl.cc b/chromium/gin/debug_impl.cc
index 451744c1d85..fa0e33af890 100644
--- a/chromium/gin/debug_impl.cc
+++ b/chromium/gin/debug_impl.cc
@@ -6,7 +6,7 @@
 
 #include "build/build_config.h"
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
 #include "v8/include/v8-initialization.h"
 #endif
 
@@ -21,7 +21,7 @@ void Debug::SetJitCodeEventHandler(v8::JitCodeEventHandler event_handler) {
   g_jit_code_event_handler = event_handler;
 }
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
 // static
 void Debug::SetUnhandledExceptionCallback(
     v8::UnhandledExceptionCallback callback) {
diff --git a/chromium/gin/gin_features.cc b/chromium/gin/gin_features.cc
index ab83bb99fb3..84e42279760 100644
--- a/chromium/gin/gin_features.cc
+++ b/chromium/gin/gin_features.cc
@@ -119,15 +119,10 @@ const base::Feature kV8SlowHistogramsSparkplugAndroid{
 const base::Feature kV8SlowHistogramsScriptAblation{
     "V8SlowHistogramsScriptAblation", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Enables the V8 virtual memory cage.
-const base::Feature kV8VirtualMemoryCage {
-  "V8VirtualMemoryCage",
-#if defined(V8_HEAP_SANDBOX)
-      // The cage is required for the V8 Heap Sandbox.
-      base::FEATURE_ENABLED_BY_DEFAULT
-#else
-      base::FEATURE_DISABLED_BY_DEFAULT
-#endif
-};
+// Enables the experimental V8 sandbox. This is called V8VirtualMemoryCage
+// instead of V8Sandbox for historical reasons.
+// TODO(1218005) remove this once the finch trial has ended.
+const base::Feature kV8VirtualMemoryCage{"V8VirtualMemoryCage",
+                                         base::FEATURE_DISABLED_BY_DEFAULT};
 
 }  // namespace features
diff --git a/chromium/gin/isolate_holder.cc b/chromium/gin/isolate_holder.cc
index 6305d03e231..00190da5134 100644
--- a/chromium/gin/isolate_holder.cc
+++ b/chromium/gin/isolate_holder.cc
@@ -57,7 +57,9 @@ IsolateHolder::IsolateHolder(
     IsolateType isolate_type,
     IsolateCreationMode isolate_creation_mode,
     v8::CreateHistogramCallback create_histogram_callback,
-    v8::AddHistogramSampleCallback add_histogram_sample_callback)
+    v8::AddHistogramSampleCallback add_histogram_sample_callback,
+    v8::FatalErrorCallback fatal_error_callback,
+    v8::OOMErrorCallback oom_error_callback)
     : access_mode_(access_mode), isolate_type_(isolate_type) {
   CHECK(Initialized())
       << "You need to invoke gin::IsolateHolder::Initialize first";
@@ -92,6 +94,8 @@ IsolateHolder::IsolateHolder(
     params.embedder_wrapper_object_index = kEncodedValueIndex;
     params.create_histogram_callback = create_histogram_callback;
     params.add_histogram_sample_callback = add_histogram_sample_callback;
+    params.fatal_error_callback = fatal_error_callback;
+    params.oom_error_callback = oom_error_callback;
 
     v8::Isolate::Initialize(isolate_, params);
   }
@@ -106,8 +110,10 @@ IsolateHolder::IsolateHolder(
 
 IsolateHolder::~IsolateHolder() {
   isolate_memory_dump_provider_.reset();
-  isolate_data_.reset();
+  // Calling Isolate::Dispose makes sure all threads which might access
+  // PerIsolateData are finished.
   isolate_->Dispose();
+  isolate_data_.reset();
   isolate_ = nullptr;
 }
 
diff --git a/chromium/gin/object_template_builder.h b/chromium/gin/object_template_builder.h
index 60265ea6d73..d2a63883802 100644
--- a/chromium/gin/object_template_builder.h
+++ b/chromium/gin/object_template_builder.h
@@ -5,7 +5,6 @@
 #ifndef GIN_OBJECT_TEMPLATE_BUILDER_H_
 #define GIN_OBJECT_TEMPLATE_BUILDER_H_
 
-#include <tuple>
 #include <type_traits>
 #include <utility>
 
@@ -105,9 +104,7 @@ class GIN_EXPORT ObjectTemplateBuilder {
       options.holder_is_first_argument = true;
       options.holder_type = type_name_;
     }
-    v8::AccessorNameGetterCallback callback;
-    v8::Local<v8::Value> data;
-    std::tie(callback, data) = CreateDataPropertyCallback(
+    auto [callback, data] = CreateDataPropertyCallback(
         isolate_, base::BindRepeating(getter), std::move(options));
     return SetLazyDataPropertyImpl(name, callback, data);
   }
diff --git a/chromium/gin/per_isolate_data.cc b/chromium/gin/per_isolate_data.cc
index 888b984fb8b..2ccec600dc7 100644
--- a/chromium/gin/per_isolate_data.cc
+++ b/chromium/gin/per_isolate_data.cc
@@ -42,9 +42,7 @@ PerIsolateData::PerIsolateData(
   }
 }
 
-PerIsolateData::~PerIsolateData() {
-  isolate_->SetData(kEmbedderNativeGin, NULL);
-}
+PerIsolateData::~PerIsolateData() = default;
 
 PerIsolateData* PerIsolateData::From(Isolate* isolate) {
   return static_cast<PerIsolateData*>(isolate->GetData(kEmbedderNativeGin));
diff --git a/chromium/gin/public/context_holder.h b/chromium/gin/public/context_holder.h
index 3d403c05e86..54fa62327dd 100644
--- a/chromium/gin/public/context_holder.h
+++ b/chromium/gin/public/context_holder.h
@@ -5,7 +5,6 @@
 #ifndef GIN_PUBLIC_CONTEXT_HOLDER_H_
 #define GIN_PUBLIC_CONTEXT_HOLDER_H_
 
-#include <list>
 #include <memory>
 
 #include "base/memory/raw_ptr.h"
diff --git a/chromium/gin/public/debug.h b/chromium/gin/public/debug.h
index 669c6ae2fee..b7eb3cebd8d 100644
--- a/chromium/gin/public/debug.h
+++ b/chromium/gin/public/debug.h
@@ -23,7 +23,7 @@ class GIN_EXPORT Debug {
    */
   static void SetJitCodeEventHandler(v8::JitCodeEventHandler event_handler);
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
   /* Sets a callback that is invoked for exceptions that arise in V8-generated
    * code (jitted code or embedded builtins).
    */
diff --git a/chromium/gin/public/isolate_holder.h b/chromium/gin/public/isolate_holder.h
index 78133f9b343..1e36669dfb2 100644
--- a/chromium/gin/public/isolate_holder.h
+++ b/chromium/gin/public/isolate_holder.h
@@ -82,7 +82,9 @@ class GIN_EXPORT IsolateHolder {
       IsolateType isolate_type,
       IsolateCreationMode isolate_creation_mode = IsolateCreationMode::kNormal,
       v8::CreateHistogramCallback create_histogram_callback = nullptr,
-      v8::AddHistogramSampleCallback add_histogram_sample_callback = nullptr);
+      v8::AddHistogramSampleCallback add_histogram_sample_callback = nullptr,
+      v8::FatalErrorCallback fatal_error_callback = nullptr,
+      v8::OOMErrorCallback oom_error_callback = nullptr);
   IsolateHolder(const IsolateHolder&) = delete;
   IsolateHolder& operator=(const IsolateHolder&) = delete;
   ~IsolateHolder();
diff --git a/chromium/gin/shell/gin_shell_unittest.cc b/chromium/gin/shell/gin_shell_unittest.cc
index 5c7dd0cd9e2..d4ada6a67f1 100644
--- a/chromium/gin/shell/gin_shell_unittest.cc
+++ b/chromium/gin/shell/gin_shell_unittest.cc
@@ -7,12 +7,13 @@
 #include "base/path_service.h"
 #include "base/process/launch.h"
 #include "base/strings/string_util.h"
+#include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 base::FilePath GinShellPath() {
   base::FilePath dir;
   base::PathService::Get(base::DIR_EXE, &dir);
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
   return dir.AppendASCII("gin_shell.exe");
 #else
   return dir.AppendASCII("gin_shell");
diff --git a/chromium/gin/v8_foreground_task_runner.cc b/chromium/gin/v8_foreground_task_runner.cc
index 53500d1a873..a95e0302297 100644
--- a/chromium/gin/v8_foreground_task_runner.cc
+++ b/chromium/gin/v8_foreground_task_runner.cc
@@ -8,6 +8,7 @@
 #include "base/callback_helpers.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
 
 namespace gin {
 
diff --git a/chromium/gin/v8_foreground_task_runner_with_locker.cc b/chromium/gin/v8_foreground_task_runner_with_locker.cc
index 4451bfc98bf..a06da0cdab7 100644
--- a/chromium/gin/v8_foreground_task_runner_with_locker.cc
+++ b/chromium/gin/v8_foreground_task_runner_with_locker.cc
@@ -9,6 +9,7 @@
 #include "base/memory/raw_ptr.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
 #include "v8/include/v8-locker.h"
 
 namespace gin {
diff --git a/chromium/gin/v8_initializer.cc b/chromium/gin/v8_initializer.cc
index f576fc909ee..f411bbde031 100644
--- a/chromium/gin/v8_initializer.cc
+++ b/chromium/gin/v8_initializer.cc
@@ -7,6 +7,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <cstdint>
 #include <memory>
 
 #include "base/allocator/partition_allocator/page_allocator.h"
@@ -39,9 +40,9 @@
 #include "v8/include/v8-snapshot.h"
 
 #if defined(V8_USE_EXTERNAL_STARTUP_DATA)
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/apk_assets.h"
-#elif defined(OS_MAC)
+#elif BUILDFLAG(IS_MAC)
 #include "base/mac/foundation_util.h"
 #endif
 #endif  // V8_USE_EXTERNAL_STARTUP_DATA
@@ -75,7 +76,7 @@ void GetMappedFileData(base::MemoryMappedFile* mapped_file,
 
 #if defined(V8_USE_EXTERNAL_STARTUP_DATA)
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 const char kV8ContextSnapshotFileName64[] = "v8_context_snapshot_64.bin";
 const char kV8ContextSnapshotFileName32[] = "v8_context_snapshot_32.bin";
 const char kSnapshotFileName64[] = "snapshot_blob_64.bin";
@@ -89,12 +90,12 @@ const char kSnapshotFileName32[] = "snapshot_blob_32.bin";
 #define kSnapshotFileName kSnapshotFileName32
 #endif
 
-#else  // defined(OS_ANDROID)
+#else  // BUILDFLAG(IS_ANDROID)
 #if defined(USE_V8_CONTEXT_SNAPSHOT)
 const char kV8ContextSnapshotFileName[] = V8_CONTEXT_SNAPSHOT_FILENAME;
 #endif
 const char kSnapshotFileName[] = "snapshot_blob.bin";
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 const char* GetSnapshotFileName(const V8SnapshotFileType file_type) {
   switch (file_type) {
@@ -113,11 +114,11 @@ const char* GetSnapshotFileName(const V8SnapshotFileType file_type) {
 }
 
 void GetV8FilePath(const char* file_name, base::FilePath* path_out) {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // This is the path within the .apk.
   *path_out =
       base::FilePath(FILE_PATH_LITERAL("assets")).AppendASCII(file_name);
-#elif defined(OS_MAC)
+#elif BUILDFLAG(IS_MAC)
   base::ScopedCFTypeRef<CFStringRef> bundle_resource(
       base::SysUTF8ToCFStringRef(file_name));
   *path_out = base::mac::PathForFrameworkBundleResource(bundle_resource);
@@ -158,7 +159,7 @@ base::File OpenV8File(const char* file_name,
   base::FilePath path;
   GetV8FilePath(file_name, &path);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   base::File file(base::android::OpenApkAsset(path.value(), region_out));
   OpenV8FileResult result = file.IsValid() ? OpenV8FileResult::OPENED
                                            : OpenV8FileResult::FAILED_OTHER;
@@ -189,7 +190,7 @@ base::File OpenV8File(const char* file_name,
       base::PlatformThread::Sleep(base::Milliseconds(kOpenRetryDelayMillis));
     }
   }
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
   UMA_HISTOGRAM_ENUMERATION("V8.Initializer.OpenV8File.Result", result,
                             OpenV8FileResult::MAX_VALUE);
@@ -212,7 +213,7 @@ void SetV8FlagsFormatted(const char* format, ...) {
     PLOG(ERROR) << "Invalid formatted V8 flag: " << format;
     return;
   }
-  v8::V8::SetFlagsFromString(buffer, length - 1);
+  v8::V8::SetFlagsFromString(buffer, length);
 }
 
 template <size_t N, size_t M>
@@ -352,29 +353,40 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
   // of the virtual memory cage, already use V8's random number generator.
   v8::V8::SetEntropySource(&GenerateEntropy);
 
-#if defined(V8_VIRTUAL_MEMORY_CAGE)
-  static_assert(ARCH_CPU_64_BITS,
-                "V8 virtual memory cage can only work in 64-bit builds");
-  // For now, creating the virtual memory cage is optional, and we only do it
-  // if the correpsonding feature is enabled. In the future, it will be
-  // mandatory when compiling with V8_VIRTUAL_MEMORY_CAGE.
-  bool v8_cage_is_initialized = false;
-  if (base::FeatureList::IsEnabled(features::kV8VirtualMemoryCage)) {
-    v8_cage_is_initialized = v8::V8::InitializeVirtualMemoryCage();
-
-    // Record the size of the virtual memory cage, in GB. The size will always
-    // be a power of two, so we use a sparse histogram to capture it.
-    // If the initialization failed, this API will return zero.
-    // The main reason for capturing this histogram here instead of having V8
-    // do it is that there are no Isolates available yet, which are required
-    // for recording histograms in V8.
-    size_t size = v8::V8::GetVirtualMemoryCageSizeInBytes();
+#if defined(V8_SANDBOX)
+  static_assert(ARCH_CPU_64_BITS, "V8 sandbox can only work in 64-bit builds");
+  // For now, initializing the sandbox is optional, and we only do it if the
+  // correpsonding feature is enabled. In the future, it will be mandatory when
+  // compiling with V8_SANDBOX.
+  // However, if V8 uses sandboxed pointers, then the sandbox must be
+  // initialized as sandboxed pointers are simply offsets inside the sandbox.
+#if defined(V8_SANDBOXED_POINTERS)
+  bool must_initialize_sandbox = true;
+#else
+  bool must_initialize_sandbox = false;
+#endif
+
+  bool v8_sandbox_is_initialized = false;
+  if (must_initialize_sandbox ||
+      base::FeatureList::IsEnabled(features::kV8VirtualMemoryCage)) {
+    v8_sandbox_is_initialized = v8::V8::InitializeSandbox();
+    CHECK(!must_initialize_sandbox || v8_sandbox_is_initialized);
+
+    // Record the size of the sandbox, in GB. The size will always be a power
+    // of two, so we use a sparse histogram to capture it. If the
+    // initialization failed, this API will return zero. The main reason for
+    // capturing this histogram here instead of having V8 do it is that there
+    // are no Isolates available yet, which are required for recording
+    // histograms in V8.
+    size_t size = v8::V8::GetSandboxSizeInBytes();
     int sizeInGB = size >> 30;
     DCHECK(base::bits::IsPowerOfTwo(size));
     DCHECK(size == 0 || sizeInGB > 0);
+    // This uses the term "cage" instead of "sandbox" for historical reasons.
+    // TODO(1218005) remove this once the finch trial has ended.
     base::UmaHistogramSparse("V8.VirtualMemoryCageSizeGB", sizeInGB);
   }
-#endif
+#endif  // V8_SANDBOX
 
   SetFlags(mode, js_command_line_flags);
 
@@ -390,38 +402,39 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
 
   v8_is_initialized = true;
 
-#if defined(V8_VIRTUAL_MEMORY_CAGE)
-  if (v8_cage_is_initialized) {
+#if defined(V8_SANDBOX)
+  if (v8_sandbox_is_initialized) {
     // These values are persisted to logs. Entries should not be renumbered and
     // numeric values should never be reused. This should match enum
     // V8VirtualMemoryCageMode in \tools\metrics\histograms\enums.xml
+    // This uses the term "cage" instead of "sandbox" for historical reasons.
+    // TODO(1218005) remove this once the finch trial has ended.
     enum class VirtualMemoryCageMode {
       kSecure = 0,
       kInsecure = 1,
       kMaxValue = kInsecure,
     };
     base::UmaHistogramEnumeration("V8.VirtualMemoryCageMode",
-                                  v8::V8::IsUsingSecureVirtualMemoryCage()
+                                  v8::V8::IsSandboxConfiguredSecurely()
                                       ? VirtualMemoryCageMode::kSecure
                                       : VirtualMemoryCageMode::kInsecure);
 
-    // When the virtual memory cage is enabled, ArrayBuffers must be located
-    // inside the cage. To achieve that, PA's ConfigurablePool is created inside
-    // the cage and Blink will create the ArrayBuffer partition inside that
-    // Pool if it is enabled.
-    v8::PageAllocator* cage_page_allocator =
-        v8::V8::GetVirtualMemoryCagePageAllocator();
+    // When the sandbox is enabled, ArrayBuffers must be allocated inside of
+    // it. To achieve that, PA's ConfigurablePool is created inside the sandbox
+    // and Blink then creates the ArrayBuffer partition in that Pool.
+    v8::VirtualAddressSpace* sandbox_address_space =
+        v8::V8::GetSandboxAddressSpace();
     const size_t max_pool_size =
         base::internal::PartitionAddressSpace::ConfigurablePoolMaxSize();
     const size_t min_pool_size =
         base::internal::PartitionAddressSpace::ConfigurablePoolMinSize();
     size_t pool_size = max_pool_size;
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
     // On Windows prior to 8.1 we allocate a smaller Pool since reserving
     // virtual memory is expensive on these OSes.
     if (base::win::GetVersion() < base::win::Version::WIN8_1) {
       // The size chosen here should be synchronized with the size of the
-      // virtual memory reservation for the V8 cage on these platforms.
+      // virtual memory reservation for the V8 sandbox on these platforms.
       // Currently, that is 8GB, of which 4GB are used for V8's pointer
       // compression region.
       // TODO(saelo) give this constant a proper name and maybe move it
@@ -434,21 +447,21 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
 #endif
     // Try to reserve the maximum size of the pool at first, then keep halving
     // the size on failure until it succeeds.
-    void* pool_base = nullptr;
+    uintptr_t pool_base = 0;
     while (!pool_base && pool_size >= min_pool_size) {
-      pool_base = cage_page_allocator->AllocatePages(
-          nullptr, pool_size, pool_size, v8::PageAllocator::kNoAccess);
+      pool_base = sandbox_address_space->AllocatePages(
+          0, pool_size, pool_size, v8::PagePermissions::kNoAccess);
       if (!pool_base) {
         pool_size /= 2;
       }
     }
-    // The V8 cage is guaranteed to be large enough to host the pool.
+    // The V8 sandbox is guaranteed to be large enough to host the pool.
     CHECK(pool_base);
     base::internal::PartitionAddressSpace::InitConfigurablePool(pool_base,
                                                                 pool_size);
     // TODO(saelo) maybe record the size of the Pool into UMA.
   }
-#endif
+#endif  // V8_SANDBOX
 }
 
 // static
@@ -507,7 +520,7 @@ void V8Initializer::LoadV8SnapshotFromFile(
   }
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // static
 base::FilePath V8Initializer::GetSnapshotFilePath(
     bool abi_32_bit,
@@ -528,7 +541,7 @@ base::FilePath V8Initializer::GetSnapshotFilePath(
   GetV8FilePath(filename, &path);
   return path;
 }
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 V8SnapshotFileType GetLoadedSnapshotFileType() {
   DCHECK(g_snapshot_file_type.has_value());
diff --git a/chromium/gin/v8_initializer.h b/chromium/gin/v8_initializer.h
index de650aa85dd..beeedc5737f 100644
--- a/chromium/gin/v8_initializer.h
+++ b/chromium/gin/v8_initializer.h
@@ -52,7 +52,7 @@ class GIN_EXPORT V8Initializer {
       base::MemoryMappedFile::Region* snapshot_file_region,
       V8SnapshotFileType snapshot_file_type);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   static base::FilePath GetSnapshotFilePath(
       bool abi_32_bit,
       V8SnapshotFileType snapshot_file_type);
diff --git a/chromium/gin/v8_platform.cc b/chromium/gin/v8_platform.cc
index 0ccafbde90f..a7dad3d1053 100644
--- a/chromium/gin/v8_platform.cc
+++ b/chromium/gin/v8_platform.cc
@@ -127,7 +127,7 @@ class TimeClamper {
  public:
 // As site isolation is enabled on desktop platforms, we can safely provide
 // more timing resolution. Jittering is still enabled everywhere.
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   static constexpr double kResolutionSeconds = 100e-6;
 #else
   static constexpr double kResolutionSeconds = 5e-6;
@@ -371,7 +371,7 @@ PageAllocator* V8Platform::GetPageAllocator() {
 void V8Platform::OnCriticalMemoryPressure() {
 // We only have a reservation on 32-bit Windows systems.
 // TODO(bbudge) Make the #if's in BlinkInitializer match.
-#if defined(OS_WIN) && defined(ARCH_CPU_32_BITS)
+#if BUILDFLAG(IS_WIN) && defined(ARCH_CPU_32_BITS)
   base::ReleaseReservation();
 #endif
 }
diff --git a/chromium/gin/v8_platform_page_allocator.cc b/chromium/gin/v8_platform_page_allocator.cc
index 49b3ca66144..b1be62dbed0 100644
--- a/chromium/gin/v8_platform_page_allocator.cc
+++ b/chromium/gin/v8_platform_page_allocator.cc
@@ -9,38 +9,42 @@
 #include "base/allocator/partition_allocator/random.h"
 #include "base/check_op.h"
 #include "base/cpu.h"
+#include "build/build_config.h"
 
 namespace {
 
 // Maps the v8 page permissions into a page configuration from base.
-base::PageAccessibilityConfiguration GetPageConfig(
+::partition_alloc::PageAccessibilityConfiguration GetPageConfig(
     v8::PageAllocator::Permission permission) {
   switch (permission) {
     case v8::PageAllocator::Permission::kRead:
-      return base::PageRead;
+      return ::partition_alloc::PageAccessibilityConfiguration::kRead;
     case v8::PageAllocator::Permission::kReadWrite:
-      return base::PageReadWrite;
+      return ::partition_alloc::PageAccessibilityConfiguration::kReadWrite;
     case v8::PageAllocator::Permission::kReadWriteExecute:
       // at the moment bti-protection is not enabled for this path since some
       // projects may still be using non-bti compliant code.
-      return base::PageReadWriteExecute;
+      return ::partition_alloc::PageAccessibilityConfiguration::
+          kReadWriteExecute;
     case v8::PageAllocator::Permission::kReadExecute:
 #if defined(__ARM_FEATURE_BTI_DEFAULT)
       return base::CPU::GetInstanceNoAllocation().has_bti()
-                 ? base::PageReadExecuteProtected
-                 : base::PageReadExecute;
+                 ? ::partition_alloc::PageAccessibilityConfiguration::
+                       kReadExecuteProtected
+                 : ::partition_alloc::PageAccessibilityConfiguration::
+                       kReadExecute;
 #else
-      return base::PageReadExecute;
+      return ::partition_alloc::PageAccessibilityConfiguration::kReadExecute;
 #endif
     case v8::PageAllocator::Permission::kNoAccessWillJitLater:
       // We could use this information to conditionally set the MAP_JIT flag
       // on Mac-arm64; however this permissions value is intended to be a
       // short-term solution, so we continue to set MAP_JIT for all V8 pages
       // for now.
-      return base::PageInaccessible;
+      return ::partition_alloc::PageAccessibilityConfiguration::kInaccessible;
     default:
       DCHECK_EQ(v8::PageAllocator::Permission::kNoAccess, permission);
-      return base::PageInaccessible;
+      return ::partition_alloc::PageAccessibilityConfiguration::kInaccessible;
   }
 }
 
@@ -58,11 +62,11 @@ size_t PageAllocator::CommitPageSize() {
 }
 
 void PageAllocator::SetRandomMmapSeed(int64_t seed) {
-  base::SetMmapSeedForTesting(seed);
+  ::partition_alloc::SetMmapSeedForTesting(seed);
 }
 
 void* PageAllocator::GetRandomMmapAddr() {
-  return base::GetRandomPageBase();
+  return reinterpret_cast<void*>(::partition_alloc::GetRandomPageBase());
 }
 
 void* PageAllocator::AllocatePages(void* address,
@@ -85,15 +89,16 @@ bool PageAllocator::ReleasePages(void* address,
   DCHECK_LT(new_length, length);
   uint8_t* release_base = reinterpret_cast<uint8_t*>(address) + new_length;
   size_t release_size = length - new_length;
-#if defined(OS_POSIX) || defined(OS_FUCHSIA)
+#if BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
   // On POSIX, we can unmap the trailing pages.
   base::FreePages(release_base, release_size);
-#elif defined(OS_WIN)
+#elif BUILDFLAG(IS_WIN)
   // On Windows, we can only de-commit the trailing pages. FreePages() will
   // still free all pages in the region including the released tail, so it's
   // safe to just decommit the tail.
-  base::DecommitSystemPages(release_base, release_size,
-                            base::PageUpdatePermissions);
+  base::DecommitSystemPages(
+      release_base, release_size,
+      ::partition_alloc::PageAccessibilityDisposition::kRequireUpdate);
 #else
 #error Unsupported platform
 #endif
@@ -105,12 +110,13 @@ bool PageAllocator::SetPermissions(void* address,
                                    Permission permissions) {
   // If V8 sets permissions to none, we can discard the memory.
   if (permissions == v8::PageAllocator::Permission::kNoAccess) {
-    // Use PageKeepPermissionsIfPossible as an optimization, to avoid perf
-    // regression (see crrev.com/c/2563038 for details). This may cause the
-    // memory region to still be accessible on certain platforms, but at least
-    // the physical pages will be discarded.
-    base::DecommitSystemPages(address, length,
-                              base::PageKeepPermissionsIfPossible);
+    // Use PageAccessibilityDisposition::kAllowKeepForPerf as an
+    // optimization, to avoid perf regression (see crrev.com/c/2563038 for
+    // details). This may cause the memory region to still be accessible on
+    // certain platforms, but at least the physical pages will be discarded.
+    base::DecommitSystemPages(
+        address, length,
+        ::partition_alloc::PageAccessibilityDisposition::kAllowKeepForPerf);
     return true;
   } else {
     return base::TrySetSystemPagesAccess(address, length,
diff --git a/chromium/gin/v8_platform_page_allocator.h b/chromium/gin/v8_platform_page_allocator.h
index dc13666b3b6..bf573d46702 100644
--- a/chromium/gin/v8_platform_page_allocator.h
+++ b/chromium/gin/v8_platform_page_allocator.h
@@ -50,11 +50,11 @@ class GIN_EXPORT PageAllocator final : public v8::PageAllocator {
 
   // For testing purposes only: Map the v8 page permissions into a page
   // configuration from base.
-  base::PageAccessibilityConfiguration GetPageConfigForTesting(
+  ::partition_alloc::PageAccessibilityConfiguration GetPageConfigForTesting(
       v8::PageAllocator::Permission permission);
 };
 }  // namespace gin
 
 #endif  // BUILDFLAG(USE_PARTITION_ALLOC)
 
-#endif  // GIN_V8_PLATFROM_PAGE_ALLOCATOR_H_
\ No newline at end of file
+#endif  // GIN_V8_PLATFROM_PAGE_ALLOCATOR_H_
diff --git a/chromium/gin/v8_platform_page_allocator_unittest.cc b/chromium/gin/v8_platform_page_allocator_unittest.cc
index c5c0a256db2..efc620951c7 100644
--- a/chromium/gin/v8_platform_page_allocator_unittest.cc
+++ b/chromium/gin/v8_platform_page_allocator_unittest.cc
@@ -5,7 +5,7 @@
 #include "gin/v8_platform_page_allocator.h"
 
 #include "base/cpu.h"
-
+#include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 // includes for Branch Target Instruction tests
@@ -14,7 +14,7 @@
 
 #include "base/allocator/partition_allocator/arm_bti_test_functions.h"
 #include "base/allocator/partition_allocator/page_allocator_constants.h"
-#if defined(OS_POSIX)
+#if BUILDFLAG(IS_POSIX)
 #include <signal.h>
 #include "testing/gtest/include/gtest/gtest-death-test.h"
 #endif
@@ -26,27 +26,28 @@ TEST(V8PlatformPageAllocatorTest, VerifyGetPageConfig) {
   auto sut = gin::PageAllocator();
 
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kNoAccess),
-           base::PageInaccessible);
+           partition_alloc::PageAccessibilityConfiguration::kInaccessible);
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kRead),
-           base::PageRead);
+           partition_alloc::PageAccessibilityConfiguration::kRead);
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kReadWrite),
-           base::PageReadWrite);
+           partition_alloc::PageAccessibilityConfiguration::kReadWrite);
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kReadWriteExecute),
-           base::PageReadWriteExecute);
+           partition_alloc::PageAccessibilityConfiguration::kReadWriteExecute);
 
 #if defined(__ARM_FEATURE_BTI_DEFAULT)
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kReadExecute),
            base::CPU::GetInstanceNoAllocation().has_bti()
-               ? base::PageReadExecuteProtected
-               : base::PageReadExecute);
+               ? partition_alloc::PageAccessibilityConfiguration::
+                     kReadExecuteProtected
+               : partition_alloc::PageAccessibilityConfiguration::kReadExecute);
 #else
   CHECK_EQ(sut.GetPageConfigForTesting(v8::PageAllocator::kReadExecute),
-           base::PageReadExecute);
+           partition_alloc::PageAccessibilityConfiguration::kReadExecute);
 #endif
 
   CHECK_EQ(
       sut.GetPageConfigForTesting(v8::PageAllocator::kNoAccessWillJitLater),
-      base::PageInaccessible);
+      partition_alloc::PageAccessibilityConfiguration::kInaccessible);
 }
 
 #if defined(ARCH_CPU_ARM64) && (OS_LINUX || OS_ANDROID)
@@ -98,11 +99,11 @@ TEST(V8PlatformPageAllocatorBTITest, VerifyReadExecutePagesAreProtected) {
   // the actual CPU we are running on. The code that were are trying to execute
   // is assembly code and always has BTI enabled.
   if (base::CPU::GetInstanceNoAllocation().has_bti()) {
-#if defined(OS_POSIX)  // signal handling is available on POSIX compliant
-                       // systems only
+#if BUILDFLAG(IS_POSIX)  // signal handling is available on POSIX compliant
+                         // systems only
     EXPECT_EXIT({ bti_invalid_fn(15); }, testing::KilledBySignal(SIGILL),
                 "");  // Should crash with SIGILL.
-#endif                // defined(OS_POSIX)
+#endif                // BUILDFLAG(IS_POSIX)
   } else {
     EXPECT_EQ(bti_invalid_fn(15), 17);
   }