BASELINE: Update Chromium to 91.0.4472.160

Change-Id: I0def1f08a2412aeed79a9ab95dd50eb5c3f65f31
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

11 files changed, 112 insertions, 85 deletions

diff --git a/chromium/gin/BUILD.gn b/chromium/gin/BUILD.gn
index dfc59c17382..86ce11a6c61 100644
--- a/chromium/gin/BUILD.gn
+++ b/chromium/gin/BUILD.gn
@@ -172,4 +172,11 @@ test("gin_unittests") {
       deps += [ "//v8:v8_external_startup_data_assets" ]
     }
   }
+
+  if (is_fuchsia) {
+    additional_manifest_fragments = [
+      # TODO(crbug.com/1185811): Figure out why jit_capabilities is needed.
+      "//build/config/fuchsia/test/jit_capabilities.test-cmx",
+    ]
+  }
 }
diff --git a/chromium/gin/context_holder.cc b/chromium/gin/context_holder.cc
index 114871778ae..23cbc326558 100644
--- a/chromium/gin/context_holder.cc
+++ b/chromium/gin/context_holder.cc
@@ -4,6 +4,8 @@
 
 #include "gin/public/context_holder.h"
 
+#include <memory>
+
 #include "base/check.h"
 #include "gin/per_context_data.h"
 
@@ -22,7 +24,7 @@ void ContextHolder::SetContext(v8::Local<v8::Context> context) {
   DCHECK(context_.IsEmpty());
   context_.Reset(isolate_, context);
   context_.AnnotateStrongRetainer("gin::ContextHolder::context_");
-  data_.reset(new PerContextData(this, context));
+  data_ = std::make_unique<PerContextData>(this, context);
 }
 
 }  // namespace gin
diff --git a/chromium/gin/converter.cc b/chromium/gin/converter.cc
index 3498080ea5b..dd7bf46f85d 100644
--- a/chromium/gin/converter.cc
+++ b/chromium/gin/converter.cc
@@ -152,17 +152,17 @@ bool Converter<std::string>::FromV8(Isolate* isolate,
   return true;
 }
 
-Local<Value> Converter<base::string16>::ToV8(Isolate* isolate,
-                                             const base::string16& val) {
+Local<Value> Converter<std::u16string>::ToV8(Isolate* isolate,
+                                             const std::u16string& val) {
   return String::NewFromTwoByte(isolate,
                                 reinterpret_cast<const uint16_t*>(val.data()),
                                 v8::NewStringType::kNormal, val.size())
       .ToLocalChecked();
 }
 
-bool Converter<base::string16>::FromV8(Isolate* isolate,
+bool Converter<std::u16string>::FromV8(Isolate* isolate,
                                        Local<Value> val,
-                                       base::string16* out) {
+                                       std::u16string* out) {
   if (!val->IsString())
     return false;
   Local<String> str = Local<String>::Cast(val);
diff --git a/chromium/gin/converter.h b/chromium/gin/converter.h
index 9e9db93e347..18068d8da0d 100644
--- a/chromium/gin/converter.h
+++ b/chromium/gin/converter.h
@@ -14,7 +14,6 @@
 
 #include "base/check.h"
 #include "base/notreached.h"
-#include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
 #include "gin/gin_export.h"
 #include "v8/include/v8.h"
@@ -123,12 +122,12 @@ struct GIN_EXPORT Converter<std::string> {
 };
 
 template <>
-struct GIN_EXPORT Converter<base::string16> {
+struct GIN_EXPORT Converter<std::u16string> {
   static v8::Local<v8::Value> ToV8(v8::Isolate* isolate,
-                                   const base::string16& val);
+                                   const std::u16string& val);
   static bool FromV8(v8::Isolate* isolate,
                      v8::Local<v8::Value> val,
-                     base::string16* out);
+                     std::u16string* out);
 };
 
 template <>
diff --git a/chromium/gin/converter_unittest.cc b/chromium/gin/converter_unittest.cc
index 162572385bd..f3f57bed24d 100644
--- a/chromium/gin/converter_unittest.cc
+++ b/chromium/gin/converter_unittest.cc
@@ -8,9 +8,10 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <string>
+
 #include "base/compiler_specific.h"
 #include "base/stl_util.h"
-#include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "gin/function_template.h"
 #include "gin/handle.h"
@@ -87,24 +88,23 @@ TEST_F(ConverterTest, String16) {
 
   HandleScope handle_scope(isolate);
 
-  EXPECT_TRUE(Converter<base::string16>::ToV8(isolate, base::ASCIIToUTF16(""))
+  EXPECT_TRUE(Converter<std::u16string>::ToV8(isolate, u"")
                   ->StrictEquals(StringToV8(isolate, "")));
-  EXPECT_TRUE(
-      Converter<base::string16>::ToV8(isolate, base::ASCIIToUTF16("hello"))
-          ->StrictEquals(StringToV8(isolate, "hello")));
+  EXPECT_TRUE(Converter<std::u16string>::ToV8(isolate, u"hello")
+                  ->StrictEquals(StringToV8(isolate, "hello")));
 
-  base::string16 result;
+  std::u16string result;
 
   ASSERT_FALSE(
-      Converter<base::string16>::FromV8(isolate, v8::False(isolate), &result));
+      Converter<std::u16string>::FromV8(isolate, v8::False(isolate), &result));
   ASSERT_FALSE(
-      Converter<base::string16>::FromV8(isolate, v8::True(isolate), &result));
-  ASSERT_TRUE(Converter<base::string16>::FromV8(
+      Converter<std::u16string>::FromV8(isolate, v8::True(isolate), &result));
+  ASSERT_TRUE(Converter<std::u16string>::FromV8(
       isolate, v8::String::Empty(isolate), &result));
-  EXPECT_EQ(result, base::string16());
-  ASSERT_TRUE(Converter<base::string16>::FromV8(
+  EXPECT_EQ(result, std::u16string());
+  ASSERT_TRUE(Converter<std::u16string>::FromV8(
       isolate, StringToV8(isolate, "hello"), &result));
-  EXPECT_EQ(result, base::ASCIIToUTF16("hello"));
+  EXPECT_EQ(result, u"hello");
 }
 
 TEST_F(ConverterTest, Int32) {
diff --git a/chromium/gin/gin_features.cc b/chromium/gin/gin_features.cc
index a2137abed41..39bcfed6c13 100644
--- a/chromium/gin/gin_features.cc
+++ b/chromium/gin/gin_features.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "gin/gin_features.h"
+#include "base/metrics/field_trial_params.h"
 
 namespace features {
 
@@ -16,7 +17,7 @@ const base::Feature kV8FlushBytecode{"V8FlushBytecode",
 
 // Enables finalizing streaming JS compilations on a background thread.
 const base::Feature kV8OffThreadFinalization{"V8OffThreadFinalization",
-                                             base::FEATURE_DISABLED_BY_DEFAULT};
+                                             base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables lazy feedback allocation in V8.
 const base::Feature kV8LazyFeedbackAllocation{"V8LazyFeedbackAllocation",
@@ -62,8 +63,20 @@ const base::Feature kV8Turboprop{"V8Turboprop",
 const base::Feature kV8Sparkplug{"V8Sparkplug",
                                  base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Enables short builtin calls feature.
+const base::Feature kV8ShortBuiltinCalls{"V8ShortBuiltinCalls",
+                                         base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Enables fast API calls in TurboFan.
 const base::Feature kV8TurboFastApiCalls{"V8TurboFastApiCalls",
                                          base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Artificially delays script execution.
+const base::Feature kV8ScriptAblation{"V8ScriptAblation",
+                                      base::FEATURE_DISABLED_BY_DEFAULT};
+const base::FeatureParam<int> kV8ScriptRunDelayOnceMs{
+    &kV8ScriptAblation, "V8ScriptRunDelayOnceMs", 0};
+const base::FeatureParam<int> kV8ScriptRunDelayMs{&kV8ScriptAblation,
+                                                  "V8ScriptRunDelayMs", 0};
+
 }  // namespace features
diff --git a/chromium/gin/gin_features.h b/chromium/gin/gin_features.h
index f1158d05dbb..f2d269b2dbc 100644
--- a/chromium/gin/gin_features.h
+++ b/chromium/gin/gin_features.h
@@ -25,6 +25,10 @@ GIN_EXPORT extern const base::Feature kV8ExperimentalRegexpEngine;
 GIN_EXPORT extern const base::Feature kV8TurboFastApiCalls;
 GIN_EXPORT extern const base::Feature kV8Turboprop;
 GIN_EXPORT extern const base::Feature kV8Sparkplug;
+GIN_EXPORT extern const base::Feature kV8ScriptAblation;
+GIN_EXPORT extern const base::FeatureParam<int> kV8ScriptRunDelayOnceMs;
+GIN_EXPORT extern const base::FeatureParam<int> kV8ScriptRunDelayMs;
+GIN_EXPORT extern const base::Feature kV8ShortBuiltinCalls;
 
 }  // namespace features
 
diff --git a/chromium/gin/isolate_holder.cc b/chromium/gin/isolate_holder.cc
index 73435b1c2c0..08815f12ad8 100644
--- a/chromium/gin/isolate_holder.cc
+++ b/chromium/gin/isolate_holder.cc
@@ -62,13 +62,13 @@ IsolateHolder::IsolateHolder(
   CHECK(allocator) << "You need to invoke gin::IsolateHolder::Initialize first";
 
   isolate_ = v8::Isolate::Allocate();
-  isolate_data_.reset(
-      new PerIsolateData(isolate_, allocator, access_mode_, task_runner));
+  isolate_data_ = std::make_unique<PerIsolateData>(isolate_, allocator,
+                                                   access_mode_, task_runner);
   if (isolate_creation_mode == IsolateCreationMode::kCreateSnapshot) {
     // This branch is called when creating a V8 snapshot for Blink.
     // Note SnapshotCreator calls isolate->Enter() in its construction.
-    snapshot_creator_.reset(
-        new v8::SnapshotCreator(isolate_, g_reference_table));
+    snapshot_creator_ =
+        std::make_unique<v8::SnapshotCreator>(isolate_, g_reference_table);
     DCHECK_EQ(isolate_, snapshot_creator_->GetIsolate());
   } else {
     v8::Isolate::CreateParams params;
@@ -91,8 +91,8 @@ IsolateHolder::IsolateHolder(
   // IsolateHolder, but only the first registration will have any effect.
   gin::V8SharedMemoryDumpProvider::Register();
 
-  isolate_memory_dump_provider_.reset(
-      new V8IsolateMemoryDumpProvider(this, task_runner));
+  isolate_memory_dump_provider_ =
+      std::make_unique<V8IsolateMemoryDumpProvider>(this, task_runner);
 }
 
 IsolateHolder::~IsolateHolder() {
diff --git a/chromium/gin/shell_runner.cc b/chromium/gin/shell_runner.cc
index f0524289537..e4e84a62270 100644
--- a/chromium/gin/shell_runner.cc
+++ b/chromium/gin/shell_runner.cc
@@ -4,6 +4,8 @@
 
 #include "gin/shell_runner.h"
 
+#include <memory>
+
 #include "gin/converter.h"
 #include "gin/per_context_data.h"
 #include "gin/public/context_holder.h"
@@ -49,7 +51,7 @@ ShellRunner::ShellRunner(ShellRunnerDelegate* delegate, Isolate* isolate)
   v8::Local<v8::Context> context =
       Context::New(isolate, NULL, delegate_->GetGlobalTemplate(this, isolate));
 
-  context_holder_.reset(new ContextHolder(isolate));
+  context_holder_ = std::make_unique<ContextHolder>(isolate);
   context_holder_->SetContext(context);
   PerContextData::From(context)->set_runner(this);
 
@@ -63,7 +65,7 @@ void ShellRunner::Run(const std::string& source,
                       const std::string& resource_name) {
   v8::Isolate* isolate = GetContextHolder()->isolate();
   TryCatch try_catch(isolate);
-  v8::ScriptOrigin origin(StringToV8(isolate, resource_name));
+  v8::ScriptOrigin origin(isolate, StringToV8(isolate, resource_name));
   auto maybe_script = Script::Compile(GetContextHolder()->context(),
                                       StringToV8(isolate, source), &origin);
   v8::Local<Script> script;
diff --git a/chromium/gin/v8_initializer.cc b/chromium/gin/v8_initializer.cc
index e9cc71b9684..b84759c0673 100644
--- a/chromium/gin/v8_initializer.cc
+++ b/chromium/gin/v8_initializer.cc
@@ -21,6 +21,7 @@
 #include "base/notreached.h"
 #include "base/path_service.h"
 #include "base/rand_util.h"
+#include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/system/sys_info.h"
 #include "base/threading/platform_thread.h"
@@ -195,6 +196,24 @@ enum LoadV8FileResult {
 
 #endif  // defined(V8_USE_EXTERNAL_STARTUP_DATA)
 
+template <int LENGTH>
+void SetV8Flags(const char (&flag)[LENGTH]) {
+  v8::V8::SetFlagsFromString(flag, LENGTH - 1);
+}
+
+void SetV8FlagsFormatted(const char* format, ...) {
+  char buffer[128];
+  va_list args;
+  va_start(args, format);
+  int length = base::vsnprintf(buffer, sizeof(buffer), format, args);
+  if (length <= 0 || sizeof(buffer) <= static_cast<unsigned>(length)) {
+    PLOG(ERROR) << "Invalid formatted V8 flag: " << format;
+    return;
+  }
+  v8::V8::SetFlagsFromString(buffer, length - 1);
+  ;
+}
+
 }  // namespace
 
 // static
@@ -209,114 +228,94 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode) {
     // We avoid explicitly passing --opt if kV8OptimizeJavascript is enabled
     // since it is the default, and doing so would override flags passed
     // explicitly, e.g., via --js-flags=--no-opt.
-    static const char no_optimize[] = "--no-opt";
-    v8::V8::SetFlagsFromString(no_optimize, sizeof(no_optimize) - 1);
+    SetV8Flags("--no-opt");
   }
 
   if (!base::FeatureList::IsEnabled(features::kV8FlushBytecode)) {
-    static const char no_flush_bytecode[] = "--no-flush-bytecode";
-    v8::V8::SetFlagsFromString(no_flush_bytecode,
-                               sizeof(no_flush_bytecode) - 1);
+    SetV8Flags("--no-flush-bytecode");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8OffThreadFinalization)) {
-    static const char finalize_streaming_on_background[] =
-        "--finalize-streaming-on-background";
-    v8::V8::SetFlagsFromString(finalize_streaming_on_background,
-                               sizeof(finalize_streaming_on_background) - 1);
+    SetV8Flags("--finalize-streaming-on-background");
   }
 
   if (!base::FeatureList::IsEnabled(features::kV8LazyFeedbackAllocation)) {
-    static const char no_lazy_feedback_allocation[] =
-        "--no-lazy-feedback-allocation";
-    v8::V8::SetFlagsFromString(no_lazy_feedback_allocation,
-                               sizeof(no_lazy_feedback_allocation) - 1);
+    SetV8Flags("--no-lazy-feedback-allocation");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8ConcurrentInlining)) {
-    static const char tf_experiment_concurrent_inlining[] =
-        "--concurrent_inlining";
-    v8::V8::SetFlagsFromString(tf_experiment_concurrent_inlining,
-                               sizeof(tf_experiment_concurrent_inlining) - 1);
+    SetV8Flags("--concurrent_inlining");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8PerContextMarkingWorklist)) {
-    static const char stress_per_context_marking_worklist[] =
-        "--stress-per-context-marking-worklist";
-    v8::V8::SetFlagsFromString(stress_per_context_marking_worklist,
-                               sizeof(stress_per_context_marking_worklist) - 1);
+    SetV8Flags("--stress-per-context-marking-worklist");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8FlushEmbeddedBlobICache)) {
-    static const char experimental_flush_embedded_blob_icache[] =
-        "--experimental-flush-embedded-blob-icache";
-    v8::V8::SetFlagsFromString(
-        experimental_flush_embedded_blob_icache,
-        sizeof(experimental_flush_embedded_blob_icache) - 1);
+    SetV8Flags("--experimental-flush-embedded-blob-icache");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8ReduceConcurrentMarkingTasks)) {
-    static const char gc_experiment_reduce_concurrent_marking_tasks[] =
-        "--gc-experiment-reduce-concurrent-marking-tasks";
-    v8::V8::SetFlagsFromString(
-        gc_experiment_reduce_concurrent_marking_tasks,
-        sizeof(gc_experiment_reduce_concurrent_marking_tasks) - 1);
+    SetV8Flags("--gc-experiment-reduce-concurrent-marking-tasks");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8NoReclaimUnmodifiedWrappers)) {
-    static constexpr char no_reclaim_unmodified_wrappers[] =
-        "--no-reclaim-unmodified-wrappers";
-    v8::V8::SetFlagsFromString(no_reclaim_unmodified_wrappers,
-                               sizeof(no_reclaim_unmodified_wrappers) - 1);
+    SetV8Flags("--no-reclaim-unmodified-wrappers");
   }
 
   if (!base::FeatureList::IsEnabled(features::kV8LocalHeaps)) {
     // The --local-heaps flag is enabled by default, so we need to explicitly
     // disable it if kV8LocalHeaps is disabled.
-    static constexpr char no_local_heaps[] = "--no-local-heaps";
-    v8::V8::SetFlagsFromString(no_local_heaps, sizeof(no_local_heaps) - 1);
-
     // Also disable TurboFan's direct access if local heaps are not enabled.
-    static constexpr char no_direct_access[] = "--no-turbo-direct-heap-access";
-    v8::V8::SetFlagsFromString(no_direct_access, sizeof(no_direct_access) - 1);
+    SetV8Flags("--no-local-heaps --no-turbo-direct-heap-access");
   }
 
   if (!base::FeatureList::IsEnabled(features::kV8TurboDirectHeapAccess)) {
     // The --turbo-direct-heap-access flag is enabled by default, so we need to
     // explicitly disable it if kV8TurboDirectHeapAccess is disabled.
-    static constexpr char no_direct_access[] = "--no-turbo-direct-heap-access";
-    v8::V8::SetFlagsFromString(no_direct_access, sizeof(no_direct_access) - 1);
+    SetV8Flags("--no-turbo-direct-heap-access");
   }
 
   if (!base::FeatureList::IsEnabled(features::kV8ExperimentalRegexpEngine)) {
     // The --enable-experimental-regexp-engine-on-excessive-backtracks flag is
     // enabled by default, so we need to explicitly disable it if
     // kV8ExperimentalRegexpEngine is disabled.
-    static constexpr char no_experimental_regexp_engine[] =
-        "--no-enable-experimental-regexp-engine-on-excessive-backtracks";
-    v8::V8::SetFlagsFromString(no_experimental_regexp_engine,
-                               sizeof(no_experimental_regexp_engine) - 1);
+    SetV8Flags(
+        "--no-enable-experimental-regexp-engine-on-excessive-backtracks");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8TurboFastApiCalls)) {
-    static const char turbo_fast_api_calls[] = "--turbo-fast-api-calls";
-    v8::V8::SetFlagsFromString(turbo_fast_api_calls,
-                               sizeof(turbo_fast_api_calls) - 1);
+    SetV8Flags("--turbo-fast-api-calls");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8Turboprop)) {
-    static const char turboprop[] = "--turboprop";
-    v8::V8::SetFlagsFromString(turboprop, sizeof(turboprop) - 1);
+    SetV8Flags("--turboprop");
   }
 
   if (base::FeatureList::IsEnabled(features::kV8Sparkplug)) {
-    static const char sparkplug[] = "--sparkplug";
-    v8::V8::SetFlagsFromString(sparkplug, sizeof(sparkplug) - 1);
+    SetV8Flags("--sparkplug");
+  }
+
+  if (base::FeatureList::IsEnabled(features::kV8ScriptAblation)) {
+    if (int delay = features::kV8ScriptRunDelayMs.Get()) {
+      SetV8FlagsFormatted("--script-run-delay=%i", delay);
+    }
+    if (int delay = features::kV8ScriptRunDelayOnceMs.Get()) {
+      SetV8FlagsFormatted("--script-run-delay-once=%i", delay);
+    }
+  }
+
+  if (!base::FeatureList::IsEnabled(features::kV8ShortBuiltinCalls)) {
+    // The --short-builtin-calls flag is enabled by default on x64 and arm64
+    // desktop configurations, so we need to explicitly disable it if
+    // kV8ShortBuiltinCalls is disabled.
+    // On other configurations it's not supported, so we don't try to enable
+    // it if the feature flag is on.
+    SetV8Flags("--no-short-builtin-calls");
   }
 
   if (IsolateHolder::kStrictMode == mode) {
-    static const char use_strict[] = "--use_strict";
-    v8::V8::SetFlagsFromString(use_strict, sizeof(use_strict) - 1);
+    SetV8Flags("--use_strict");
   }
 
 #if defined(V8_USE_EXTERNAL_STARTUP_DATA)
diff --git a/chromium/gin/v8_platform.cc b/chromium/gin/v8_platform.cc
index 71b0ec4a05d..3833b0e37d2 100644
--- a/chromium/gin/v8_platform.cc
+++ b/chromium/gin/v8_platform.cc
@@ -20,6 +20,7 @@
 #include "base/task/post_job.h"
 #include "base/task/post_task.h"
 #include "base/task/task_traits.h"
+#include "base/task/thread_pool.h"
 #include "base/task/thread_pool/thread_pool_instance.h"
 #include "base/trace_event/trace_event.h"
 #include "base/tracing_buildflags.h"