BASELINE: Update Chromium to 94.0.4606.111

Change-Id: I924781584def20fc800bedf6ff41fdb96c438193
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

19 files changed, 197 insertions, 78 deletions

diff --git a/chromium/v8/include/cppgc/allocation.h b/chromium/v8/include/cppgc/allocation.h
index 7a803cf2cc4..d75f1a97296 100644
--- a/chromium/v8/include/cppgc/allocation.h
+++ b/chromium/v8/include/cppgc/allocation.h
@@ -5,25 +5,21 @@
 #ifndef INCLUDE_CPPGC_ALLOCATION_H_
 #define INCLUDE_CPPGC_ALLOCATION_H_
 
-#include <stdint.h>
-
 #include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <new>
 #include <type_traits>
+#include <utility>
 
 #include "cppgc/custom-space.h"
-#include "cppgc/garbage-collected.h"
 #include "cppgc/internal/api-constants.h"
 #include "cppgc/internal/gc-info.h"
+#include "cppgc/type-traits.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace cppgc {
 
-template <typename T>
-class MakeGarbageCollectedTraitBase;
-
-namespace internal {
-class ObjectAllocator;
-}  // namespace internal
-
 /**
  * AllocationHandle is used to allocate garbage-collected objects.
  */
diff --git a/chromium/v8/include/cppgc/cross-thread-persistent.h b/chromium/v8/include/cppgc/cross-thread-persistent.h
index fe61e9acbc3..0a9afdcd2bd 100644
--- a/chromium/v8/include/cppgc/cross-thread-persistent.h
+++ b/chromium/v8/include/cppgc/cross-thread-persistent.h
@@ -13,12 +13,34 @@
 #include "cppgc/visitor.h"
 
 namespace cppgc {
-
 namespace internal {
 
+// Wrapper around PersistentBase that allows accessing poisoned memory when
+// using ASAN. This is needed as the GC of the heap that owns the value
+// of a CTP, may clear it (heap termination, weakness) while the object
+// holding the CTP may be poisoned as itself may be deemed dead.
+class CrossThreadPersistentBase : public PersistentBase {
+ public:
+  CrossThreadPersistentBase() = default;
+  explicit CrossThreadPersistentBase(const void* raw) : PersistentBase(raw) {}
+
+  V8_CLANG_NO_SANITIZE("address") const void* GetValueFromGC() const {
+    return raw_;
+  }
+
+  V8_CLANG_NO_SANITIZE("address")
+  PersistentNode* GetNodeFromGC() const { return node_; }
+
+  V8_CLANG_NO_SANITIZE("address")
+  void ClearFromGC() const {
+    raw_ = nullptr;
+    node_ = nullptr;
+  }
+};
+
 template <typename T, typename WeaknessPolicy, typename LocationPolicy,
           typename CheckingPolicy>
-class BasicCrossThreadPersistent final : public PersistentBase,
+class BasicCrossThreadPersistent final : public CrossThreadPersistentBase,
                                          public LocationPolicy,
                                          private WeaknessPolicy,
                                          private CheckingPolicy {
@@ -38,11 +60,11 @@ class BasicCrossThreadPersistent final : public PersistentBase,
 
   BasicCrossThreadPersistent(
       SentinelPointer s, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(s), LocationPolicy(loc) {}
+      : CrossThreadPersistentBase(s), LocationPolicy(loc) {}
 
   BasicCrossThreadPersistent(
       T* raw, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(raw), LocationPolicy(loc) {
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
     if (!IsValid(raw)) return;
     PersistentRegionLock guard;
     CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
@@ -61,7 +83,7 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   BasicCrossThreadPersistent(
       UnsafeCtorTag, T* raw,
       const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(raw), LocationPolicy(loc) {
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
     if (!IsValid(raw)) return;
     CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
     SetNode(region.AllocateNode(this, &Trace));
@@ -329,12 +351,19 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   }
 
   void ClearFromGC() const {
-    if (IsValid(GetValue())) {
-      WeaknessPolicy::GetPersistentRegion(GetValue()).FreeNode(GetNode());
-      PersistentBase::ClearFromGC();
+    if (IsValid(GetValueFromGC())) {
+      WeaknessPolicy::GetPersistentRegion(GetValueFromGC())
+          .FreeNode(GetNodeFromGC());
+      CrossThreadPersistentBase::ClearFromGC();
     }
   }
 
+  // See Get() for details.
+  V8_CLANG_NO_SANITIZE("cfi-unrelated-cast")
+  T* GetFromGC() const {
+    return static_cast<T*>(const_cast<void*>(GetValueFromGC()));
+  }
+
   friend class cppgc::Visitor;
 };
 
diff --git a/chromium/v8/include/cppgc/heap-consistency.h b/chromium/v8/include/cppgc/heap-consistency.h
index 47caea18470..8e603d5d8af 100644
--- a/chromium/v8/include/cppgc/heap-consistency.h
+++ b/chromium/v8/include/cppgc/heap-consistency.h
@@ -69,6 +69,23 @@ class HeapConsistency final {
   }
 
   /**
+   * Gets the required write barrier type for a specific write.
+   * This version is meant to be used in conjunction with with a marking write
+   * barrier barrier which doesn't consider the slot.
+   *
+   * \param value The pointer to the object. May be an interior pointer to an
+   *   interface of the actual object.
+   * \param params Parameters that may be used for actual write barrier calls.
+   *   Only filled if return value indicates that a write barrier is needed. The
+   *   contents of the `params` are an implementation detail.
+   * \returns whether a write barrier is needed and which barrier to invoke.
+   */
+  static V8_INLINE WriteBarrierType
+  GetWriteBarrierType(const void* value, WriteBarrierParams& params) {
+    return internal::WriteBarrier::GetWriteBarrierType(value, params);
+  }
+
+  /**
    * Conservative Dijkstra-style write barrier that processes an object if it
    * has not yet been processed.
    *
diff --git a/chromium/v8/include/cppgc/heap-statistics.h b/chromium/v8/include/cppgc/heap-statistics.h
index 2fe6e1ae58a..8e626596e5b 100644
--- a/chromium/v8/include/cppgc/heap-statistics.h
+++ b/chromium/v8/include/cppgc/heap-statistics.h
@@ -5,7 +5,8 @@
 #ifndef INCLUDE_CPPGC_HEAP_STATISTICS_H_
 #define INCLUDE_CPPGC_HEAP_STATISTICS_H_
 
-#include <memory>
+#include <cstddef>
+#include <cstdint>
 #include <string>
 #include <vector>
 
@@ -30,19 +31,17 @@ struct HeapStatistics final {
   };
 
   /**
-   * Statistics of object types. For each type the statistics record its name,
-   * how many objects of that type were allocated, and the overall size used by
-   * these objects.
+   * Object statistics for a single type.
    */
-  struct ObjectStatistics {
-    /** Number of distinct types in the heap. */
-    size_t num_types = 0;
-    /** Name of each type in the heap. */
-    std::vector<std::string> type_name;
-    /** Number of allocated objects per each type. */
-    std::vector<size_t> type_count;
-    /** Overall size of allocated objects per each type. */
-    std::vector<size_t> type_bytes;
+  struct ObjectStatsEntry {
+    /**
+     * Number of allocated bytes.
+     */
+    size_t allocated_bytes;
+    /**
+     * Number of allocated objects.
+     */
+    size_t object_count;
   };
 
   /**
@@ -50,10 +49,15 @@ struct HeapStatistics final {
    * allocated memory size and overall used memory size for the page.
    */
   struct PageStatistics {
-    /** Overall amount of memory allocated for the page. */
-    size_t physical_size_bytes = 0;
+    /** Overall committed amount of memory for the page. */
+    size_t committed_size_bytes = 0;
+    /** Resident amount of memory held by the page. */
+    size_t resident_size_bytes = 0;
     /** Amount of memory actually used on the page. */
     size_t used_size_bytes = 0;
+    /** Statistics for object allocated on the page. Filled only when
+     * NameProvider::HideInternalNames() is false. */
+    std::vector<ObjectStatsEntry> object_statistics;
   };
 
   /**
@@ -80,29 +84,35 @@ struct HeapStatistics final {
   struct SpaceStatistics {
     /** The space name */
     std::string name;
-    /** Overall amount of memory allocated for the space. */
-    size_t physical_size_bytes = 0;
+    /** Overall committed amount of memory for the heap. */
+    size_t committed_size_bytes = 0;
+    /** Resident amount of memory held by the heap. */
+    size_t resident_size_bytes = 0;
     /** Amount of memory actually used on the space. */
     size_t used_size_bytes = 0;
     /** Statistics for each of the pages in the space. */
     std::vector<PageStatistics> page_stats;
     /** Statistics for the freelist of the space. */
     FreeListStatistics free_list_stats;
-    /** Statistics for object allocated on the space. Filled only when
-     * NameProvider::HideInternalNames() is false. */
-    ObjectStatistics object_stats;
   };
 
-  /** Overall amount of memory allocated for the heap. */
-  size_t physical_size_bytes = 0;
+  /** Overall committed amount of memory for the heap. */
+  size_t committed_size_bytes = 0;
+  /** Resident amount of memory help by the heap. */
+  size_t resident_size_bytes = 0;
   /** Amount of memory actually used on the heap. */
   size_t used_size_bytes = 0;
   /** Detail level of this HeapStatistics. */
   DetailLevel detail_level;
 
   /** Statistics for each of the spaces in the heap. Filled only when
-   * detail_level is kDetailed. */
+   * `detail_level` is `DetailLevel::kDetailed`. */
   std::vector<SpaceStatistics> space_stats;
+
+  /**
+   * Vector of `cppgc::GarbageCollected` type names.
+   */
+  std::vector<std::string> type_names;
 };
 
 }  // namespace cppgc
diff --git a/chromium/v8/include/cppgc/heap.h b/chromium/v8/include/cppgc/heap.h
index fd0512f1f18..136c4fb44d0 100644
--- a/chromium/v8/include/cppgc/heap.h
+++ b/chromium/v8/include/cppgc/heap.h
@@ -5,6 +5,8 @@
 #ifndef INCLUDE_CPPGC_HEAP_H_
 #define INCLUDE_CPPGC_HEAP_H_
 
+#include <cstddef>
+#include <cstdint>
 #include <memory>
 #include <vector>
 
diff --git a/chromium/v8/include/cppgc/internal/api-constants.h b/chromium/v8/include/cppgc/internal/api-constants.h
index a70f00710c8..7253a470893 100644
--- a/chromium/v8/include/cppgc/internal/api-constants.h
+++ b/chromium/v8/include/cppgc/internal/api-constants.h
@@ -5,8 +5,8 @@
 #ifndef INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
 #define INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
 
-#include <stddef.h>
-#include <stdint.h>
+#include <cstddef>
+#include <cstdint>
 
 #include "v8config.h"  // NOLINT(build/include_directory)
 
diff --git a/chromium/v8/include/cppgc/internal/gc-info.h b/chromium/v8/include/cppgc/internal/gc-info.h
index b9074b1ad5d..0830b194909 100644
--- a/chromium/v8/include/cppgc/internal/gc-info.h
+++ b/chromium/v8/include/cppgc/internal/gc-info.h
@@ -7,6 +7,7 @@
 
 #include <atomic>
 #include <cstdint>
+#include <type_traits>
 
 #include "cppgc/internal/finalizer-trait.h"
 #include "cppgc/internal/name-trait.h"
diff --git a/chromium/v8/include/cppgc/internal/name-trait.h b/chromium/v8/include/cppgc/internal/name-trait.h
index ae99d41c0d7..2e2da1eab4a 100644
--- a/chromium/v8/include/cppgc/internal/name-trait.h
+++ b/chromium/v8/include/cppgc/internal/name-trait.h
@@ -73,7 +73,7 @@ class NameTrait final : public NameTraitBase {
 
  private:
   static HeapObjectName GetNameFor(const NameProvider* name_provider) {
-    return {name_provider->GetName(), false};
+    return {name_provider->GetHumanReadableName(), false};
   }
 
   static HeapObjectName GetNameFor(...) {
@@ -91,7 +91,7 @@ class NameTrait final : public NameTraitBase {
 
     static const HeapObjectName leaky_name =
         GetNameFromTypeSignature(PRETTY_FUNCTION_VALUE);
-    return leaky_name;
+    return {leaky_name, false};
 
 #undef PRETTY_FUNCTION_VALUE
 
diff --git a/chromium/v8/include/cppgc/internal/persistent-node.h b/chromium/v8/include/cppgc/internal/persistent-node.h
index 5626b17820b..b5dba476a47 100644
--- a/chromium/v8/include/cppgc/internal/persistent-node.h
+++ b/chromium/v8/include/cppgc/internal/persistent-node.h
@@ -75,7 +75,7 @@ class PersistentNode final {
   TraceCallback trace_ = nullptr;
 };
 
-class V8_EXPORT PersistentRegion final {
+class V8_EXPORT PersistentRegion {
   using PersistentNodeSlots = std::array<PersistentNode, 256u>;
 
  public:
@@ -116,6 +116,9 @@ class V8_EXPORT PersistentRegion final {
  private:
   void EnsureNodeSlots();
 
+  template <typename PersistentBaseClass>
+  void ClearAllUsedNodes();
+
   std::vector<std::unique_ptr<PersistentNodeSlots>> nodes_;
   PersistentNode* free_list_head_ = nullptr;
   size_t nodes_in_use_ = 0;
@@ -135,7 +138,7 @@ class V8_EXPORT PersistentRegionLock final {
 
 // Variant of PersistentRegion that checks whether the PersistentRegionLock is
 // locked.
-class V8_EXPORT CrossThreadPersistentRegion final {
+class V8_EXPORT CrossThreadPersistentRegion final : protected PersistentRegion {
  public:
   CrossThreadPersistentRegion() = default;
   // Clears Persistent fields to avoid stale pointers after heap teardown.
@@ -147,12 +150,12 @@ class V8_EXPORT CrossThreadPersistentRegion final {
 
   V8_INLINE PersistentNode* AllocateNode(void* owner, TraceCallback trace) {
     PersistentRegionLock::AssertLocked();
-    return persistent_region_.AllocateNode(owner, trace);
+    return PersistentRegion::AllocateNode(owner, trace);
   }
 
   V8_INLINE void FreeNode(PersistentNode* node) {
     PersistentRegionLock::AssertLocked();
-    persistent_region_.FreeNode(node);
+    PersistentRegion::FreeNode(node);
   }
 
   void Trace(Visitor*);
@@ -160,9 +163,6 @@ class V8_EXPORT CrossThreadPersistentRegion final {
   size_t NodesInUse() const;
 
   void ClearAllUsedNodes();
-
- private:
-  PersistentRegion persistent_region_;
 };
 
 }  // namespace internal
diff --git a/chromium/v8/include/cppgc/internal/pointer-policies.h b/chromium/v8/include/cppgc/internal/pointer-policies.h
index e09b86199f4..cdf0bb693d6 100644
--- a/chromium/v8/include/cppgc/internal/pointer-policies.h
+++ b/chromium/v8/include/cppgc/internal/pointer-policies.h
@@ -82,7 +82,7 @@ class V8_EXPORT EnabledCheckingPolicy {
 
 class DisabledCheckingPolicy {
  protected:
-  void CheckPointer(const void* raw) {}
+  void CheckPointer(const void*) {}
 };
 
 #if V8_ENABLE_CHECKS
@@ -92,6 +92,10 @@ using DefaultPersistentCheckingPolicy = EnabledCheckingPolicy;
 using DefaultMemberCheckingPolicy = DisabledCheckingPolicy;
 using DefaultPersistentCheckingPolicy = DisabledCheckingPolicy;
 #endif
+// For CT(W)P neither marking information (for value), nor objectstart bitmap
+// (for slot) are guaranteed to be present because there's no synchonization
+// between heaps after marking.
+using DefaultCrossThreadPersistentCheckingPolicy = DisabledCheckingPolicy;
 
 class KeepLocationPolicy {
  public:
@@ -154,7 +158,7 @@ struct WeakCrossThreadPersistentPolicy {
 // Forward declarations setting up the default policies.
 template <typename T, typename WeaknessPolicy,
           typename LocationPolicy = DefaultLocationPolicy,
-          typename CheckingPolicy = DisabledCheckingPolicy>
+          typename CheckingPolicy = DefaultCrossThreadPersistentCheckingPolicy>
 class BasicCrossThreadPersistent;
 template <typename T, typename WeaknessPolicy,
           typename LocationPolicy = DefaultLocationPolicy,
diff --git a/chromium/v8/include/cppgc/internal/write-barrier.h b/chromium/v8/include/cppgc/internal/write-barrier.h
index f3aaedb1b83..28184dc9c83 100644
--- a/chromium/v8/include/cppgc/internal/write-barrier.h
+++ b/chromium/v8/include/cppgc/internal/write-barrier.h
@@ -5,9 +5,13 @@
 #ifndef INCLUDE_CPPGC_INTERNAL_WRITE_BARRIER_H_
 #define INCLUDE_CPPGC_INTERNAL_WRITE_BARRIER_H_
 
+#include <cstddef>
+#include <cstdint>
+
 #include "cppgc/heap-state.h"
 #include "cppgc/internal/api-constants.h"
 #include "cppgc/internal/atomic-entry-flag.h"
+#include "cppgc/platform.h"
 #include "cppgc/sentinel-pointer.h"
 #include "cppgc/trace-trait.h"
 #include "v8config.h"  // NOLINT(build/include_directory)
@@ -22,8 +26,11 @@ class HeapHandle;
 
 namespace internal {
 
+#if defined(CPPGC_CAGED_HEAP)
 class WriteBarrierTypeForCagedHeapPolicy;
+#else   // !CPPGC_CAGED_HEAP
 class WriteBarrierTypeForNonCagedHeapPolicy;
+#endif  // !CPPGC_CAGED_HEAP
 
 class V8_EXPORT WriteBarrier final {
  public:
@@ -60,6 +67,8 @@ class V8_EXPORT WriteBarrier final {
   template <typename HeapHandleCallback>
   static V8_INLINE Type GetWriteBarrierType(const void* slot, Params& params,
                                             HeapHandleCallback callback);
+  // Returns the required write barrier for a given  `value`.
+  static V8_INLINE Type GetWriteBarrierType(const void* value, Params& params);
 
   template <typename HeapHandleCallback>
   static V8_INLINE Type GetWriteBarrierTypeForExternallyReferencedObject(
@@ -141,9 +150,27 @@ class V8_EXPORT WriteBarrierTypeForCagedHeapPolicy final {
     return ValueModeDispatch<value_mode>::Get(slot, value, params, callback);
   }
 
+  template <WriteBarrier::ValueMode value_mode, typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type Get(const void* value,
+                                          WriteBarrier::Params& params,
+                                          HeapHandleCallback callback) {
+    return GetNoSlot(value, params, callback);
+  }
+
   template <typename HeapHandleCallback>
   static V8_INLINE WriteBarrier::Type GetForExternallyReferenced(
-      const void* value, WriteBarrier::Params& params, HeapHandleCallback) {
+      const void* value, WriteBarrier::Params& params,
+      HeapHandleCallback callback) {
+    return GetNoSlot(value, params, callback);
+  }
+
+ private:
+  WriteBarrierTypeForCagedHeapPolicy() = delete;
+
+  template <typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type GetNoSlot(const void* value,
+                                                WriteBarrier::Params& params,
+                                                HeapHandleCallback) {
     if (!TryGetCagedHeap(value, value, params)) {
       return WriteBarrier::Type::kNone;
     }
@@ -153,14 +180,14 @@ class V8_EXPORT WriteBarrierTypeForCagedHeapPolicy final {
     return SetAndReturnType<WriteBarrier::Type::kNone>(params);
   }
 
- private:
-  WriteBarrierTypeForCagedHeapPolicy() = delete;
-
   template <WriteBarrier::ValueMode value_mode>
   struct ValueModeDispatch;
 
   static V8_INLINE bool TryGetCagedHeap(const void* slot, const void* value,
                                         WriteBarrier::Params& params) {
+    // TODO(chromium:1056170): Check if the null check can be folded in with
+    // the rest of the write barrier.
+    if (!value) return false;
     params.start = reinterpret_cast<uintptr_t>(value) &
                    ~(api_constants::kCagedHeapReservationAlignment - 1);
     const uintptr_t slot_offset =
@@ -251,6 +278,15 @@ class V8_EXPORT WriteBarrierTypeForNonCagedHeapPolicy final {
     return ValueModeDispatch<value_mode>::Get(slot, value, params, callback);
   }
 
+  template <WriteBarrier::ValueMode value_mode, typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type Get(const void* value,
+                                          WriteBarrier::Params& params,
+                                          HeapHandleCallback callback) {
+    // The slot will never be used in `Get()` below.
+    return Get<WriteBarrier::ValueMode::kValuePresent>(nullptr, value, params,
+                                                       callback);
+  }
+
   template <typename HeapHandleCallback>
   static V8_INLINE WriteBarrier::Type GetForExternallyReferenced(
       const void* value, WriteBarrier::Params& params,
@@ -325,6 +361,13 @@ WriteBarrier::Type WriteBarrier::GetWriteBarrierType(
 }
 
 // static
+WriteBarrier::Type WriteBarrier::GetWriteBarrierType(
+    const void* value, WriteBarrier::Params& params) {
+  return WriteBarrierTypePolicy::Get<ValueMode::kValuePresent>(value, params,
+                                                               []() {});
+}
+
+// static
 template <typename HeapHandleCallback>
 WriteBarrier::Type
 WriteBarrier::GetWriteBarrierTypeForExternallyReferencedObject(
diff --git a/chromium/v8/include/cppgc/liveness-broker.h b/chromium/v8/include/cppgc/liveness-broker.h
index e449091280d..c94eef0d4ac 100644
--- a/chromium/v8/include/cppgc/liveness-broker.h
+++ b/chromium/v8/include/cppgc/liveness-broker.h
@@ -44,7 +44,10 @@ class V8_EXPORT LivenessBroker final {
  public:
   template <typename T>
   bool IsHeapObjectAlive(const T* object) const {
-    return object &&
+    // nullptr objects are considered alive to allow weakness to be used from
+    // stack while running into a conservative GC. Treating nullptr as dead
+    // would mean that e.g. custom collectins could not be strongified on stack.
+    return !object ||
            IsHeapObjectAliveImpl(
                TraceTrait<T>::GetTraceDescriptor(object).base_object_payload);
   }
diff --git a/chromium/v8/include/cppgc/macros.h b/chromium/v8/include/cppgc/macros.h
index 70ab44c6575..030f397e3df 100644
--- a/chromium/v8/include/cppgc/macros.h
+++ b/chromium/v8/include/cppgc/macros.h
@@ -5,7 +5,7 @@
 #ifndef INCLUDE_CPPGC_MACROS_H_
 #define INCLUDE_CPPGC_MACROS_H_
 
-#include <stddef.h>
+#include <cstddef>
 
 #include "cppgc/internal/compiler-specific.h"
 
diff --git a/chromium/v8/include/cppgc/member.h b/chromium/v8/include/cppgc/member.h
index 16aed060226..38105b8e432 100644
--- a/chromium/v8/include/cppgc/member.h
+++ b/chromium/v8/include/cppgc/member.h
@@ -218,6 +218,8 @@ class BasicMember final : private MemberBase, private CheckingPolicy {
 
   void ClearFromGC() const { MemberBase::ClearFromGC(); }
 
+  T* GetFromGC() const { return Get(); }
+
   friend class cppgc::Visitor;
   template <typename U>
   friend struct cppgc::TraceTrait;
@@ -226,20 +228,20 @@ class BasicMember final : private MemberBase, private CheckingPolicy {
 template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
           typename CheckingPolicy1, typename T2, typename WeaknessTag2,
           typename WriteBarrierPolicy2, typename CheckingPolicy2>
-bool operator==(
-    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
-    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
-        member2) {
+bool operator==(const BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1,
+                                  CheckingPolicy1>& member1,
+                const BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2,
+                                  CheckingPolicy2>& member2) {
   return member1.Get() == member2.Get();
 }
 
 template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
           typename CheckingPolicy1, typename T2, typename WeaknessTag2,
           typename WriteBarrierPolicy2, typename CheckingPolicy2>
-bool operator!=(
-    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
-    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
-        member2) {
+bool operator!=(const BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1,
+                                  CheckingPolicy1>& member1,
+                const BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2,
+                                  CheckingPolicy2>& member2) {
   return !(member1 == member2);
 }
 
diff --git a/chromium/v8/include/cppgc/name-provider.h b/chromium/v8/include/cppgc/name-provider.h
index 8b70b8ea5ee..224dd4b5d67 100644
--- a/chromium/v8/include/cppgc/name-provider.h
+++ b/chromium/v8/include/cppgc/name-provider.h
@@ -57,7 +57,7 @@ class V8_EXPORT NameProvider {
    *
    * @returns a human readable name for the object.
    */
-  virtual const char* GetName() const = 0;
+  virtual const char* GetHumanReadableName() const = 0;
 };
 
 }  // namespace cppgc
diff --git a/chromium/v8/include/cppgc/persistent.h b/chromium/v8/include/cppgc/persistent.h
index 22cda7c6e8f..b83a464576e 100644
--- a/chromium/v8/include/cppgc/persistent.h
+++ b/chromium/v8/include/cppgc/persistent.h
@@ -41,7 +41,7 @@ class PersistentBase {
     node_ = nullptr;
   }
 
- private:
+ protected:
   mutable const void* raw_ = nullptr;
   mutable PersistentNode* node_ = nullptr;
 
@@ -141,7 +141,7 @@ class BasicPersistent final : public PersistentBase,
   }
 
   // Move assignment.
-  BasicPersistent& operator=(BasicPersistent&& other) {
+  BasicPersistent& operator=(BasicPersistent&& other) noexcept {
     if (this == &other) return *this;
     Clear();
     PersistentBase::operator=(std::move(other));
@@ -259,6 +259,12 @@ class BasicPersistent final : public PersistentBase,
     }
   }
 
+  // Set Get() for details.
+  V8_CLANG_NO_SANITIZE("cfi-unrelated-cast")
+  T* GetFromGC() const {
+    return static_cast<T*>(const_cast<void*>(GetValue()));
+  }
+
   friend class cppgc::Visitor;
 };
 
diff --git a/chromium/v8/include/cppgc/platform.h b/chromium/v8/include/cppgc/platform.h
index 0d7377668cf..3276a26b652 100644
--- a/chromium/v8/include/cppgc/platform.h
+++ b/chromium/v8/include/cppgc/platform.h
@@ -5,6 +5,8 @@
 #ifndef INCLUDE_CPPGC_PLATFORM_H_
 #define INCLUDE_CPPGC_PLATFORM_H_
 
+#include <memory>
+
 #include "v8-platform.h"  // NOLINT(build/include_directory)
 #include "v8config.h"     // NOLINT(build/include_directory)
 
@@ -146,6 +148,7 @@ namespace internal {
 V8_EXPORT void Abort();
 
 }  // namespace internal
+
 }  // namespace cppgc
 
 #endif  // INCLUDE_CPPGC_PLATFORM_H_
diff --git a/chromium/v8/include/cppgc/source-location.h b/chromium/v8/include/cppgc/source-location.h
index 29d69b0a137..da5a5ede520 100644
--- a/chromium/v8/include/cppgc/source-location.h
+++ b/chromium/v8/include/cppgc/source-location.h
@@ -5,6 +5,7 @@
 #ifndef INCLUDE_CPPGC_SOURCE_LOCATION_H_
 #define INCLUDE_CPPGC_SOURCE_LOCATION_H_
 
+#include <cstddef>
 #include <string>
 
 #include "v8config.h"  // NOLINT(build/include_directory)
diff --git a/chromium/v8/include/cppgc/visitor.h b/chromium/v8/include/cppgc/visitor.h
index 98de9957bd6..57e2ce3963a 100644
--- a/chromium/v8/include/cppgc/visitor.h
+++ b/chromium/v8/include/cppgc/visitor.h
@@ -12,6 +12,7 @@
 #include "cppgc/internal/pointer-policies.h"
 #include "cppgc/liveness-broker.h"
 #include "cppgc/member.h"
+#include "cppgc/sentinel-pointer.h"
 #include "cppgc/source-location.h"
 #include "cppgc/trace-trait.h"
 #include "cppgc/type-traits.h"
@@ -318,10 +319,10 @@ class V8_EXPORT Visitor {
   template <typename PointerType>
   static void HandleWeak(const LivenessBroker& info, const void* object) {
     const PointerType* weak = static_cast<const PointerType*>(object);
+    auto* raw_ptr = weak->GetFromGC();
     // Sentinel values are preserved for weak pointers.
-    if (*weak == kSentinelPointer) return;
-    const auto* raw = weak->Get();
-    if (!info.IsHeapObjectAlive(raw)) {
+    if (raw_ptr == kSentinelPointer) return;
+    if (!info.IsHeapObjectAlive(raw_ptr)) {
       weak->ClearFromGC();
     }
   }
@@ -335,11 +336,11 @@ class V8_EXPORT Visitor {
     static_assert(internal::IsGarbageCollectedOrMixinType<PointeeType>::value,
                   "Persistent's pointee type must be GarbageCollected or "
                   "GarbageCollectedMixin");
-    if (!p.Get()) {
+    auto* ptr = p.GetFromGC();
+    if (!ptr) {
       return;
     }
-    VisitRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()),
-              loc);
+    VisitRoot(ptr, TraceTrait<PointeeType>::GetTraceDescriptor(ptr), loc);
   }
 
   template <
@@ -354,7 +355,8 @@ class V8_EXPORT Visitor {
                   "GarbageCollectedMixin");
     static_assert(!internal::IsAllocatedOnCompactableSpace<PointeeType>::value,
                   "Weak references to compactable objects are not allowed");
-    VisitWeakRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()),
+    auto* ptr = p.GetFromGC();
+    VisitWeakRoot(ptr, TraceTrait<PointeeType>::GetTraceDescriptor(ptr),
                   &HandleWeak<WeakPersistent>, &p, loc);
   }