BASELINE: Update Chromium to 94.0.4606.111

Change-Id: I924781584def20fc800bedf6ff41fdb96c438193 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2021-10-26 13:57:00 +0200
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2021-11-02 11:31:01 +0000
commit: 1943b3c2a1dcee36c233724fc4ee7613d71b9cf6 (patch)
tree: 8c1b5f12357025c197da5427ae02cfdc2f3570d6 /chromium/v8/include
parent: 21ba0c5d4bf8fba15dddd97cd693bad2358b77fd (diff)
download: qtwebengine-chromium-1943b3c2a1dcee36c233724fc4ee7613d71b9cf6.tar.gz
28 files changed, 736 insertions, 248 deletions
diff --git a/chromium/v8/include/OWNERS b/chromium/v8/include/OWNERS
index 7d538da1aa6..0222513df26 100644
--- a/chromium/v8/include/OWNERS
+++ b/chromium/v8/include/OWNERS
@@ -2,7 +2,6 @@ adamk@chromium.org
 cbruni@chromium.org
 leszeks@chromium.org
 mlippautz@chromium.org
-ulan@chromium.org
 verwaest@chromium.org
 yangguo@chromium.org
 
@@ -12,6 +11,9 @@ per-file v8-inspector.h=file:../src/inspector/OWNERS
 per-file v8-inspector-protocol.h=file:../src/inspector/OWNERS
 per-file js_protocol.pdl=file:../src/inspector/OWNERS
 
+# Needed by the auto_tag builder
+per-file v8-version.h=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com
+
 # For branch updates:
 per-file v8-version.h=file:../INFRA_OWNERS
 per-file v8-version.h=hablich@chromium.org
diff --git a/chromium/v8/include/cppgc/allocation.h b/chromium/v8/include/cppgc/allocation.h
index 7a803cf2cc4..d75f1a97296 100644
--- a/chromium/v8/include/cppgc/allocation.h
+++ b/chromium/v8/include/cppgc/allocation.h
@@ -5,25 +5,21 @@
 #ifndef INCLUDE_CPPGC_ALLOCATION_H_
 #define INCLUDE_CPPGC_ALLOCATION_H_
 
-#include <stdint.h>
-
 #include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <new>
 #include <type_traits>
+#include <utility>
 
 #include "cppgc/custom-space.h"
-#include "cppgc/garbage-collected.h"
 #include "cppgc/internal/api-constants.h"
 #include "cppgc/internal/gc-info.h"
+#include "cppgc/type-traits.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace cppgc {
 
-template <typename T>
-class MakeGarbageCollectedTraitBase;
-
-namespace internal {
-class ObjectAllocator;
-}  // namespace internal
-
 /**
  * AllocationHandle is used to allocate garbage-collected objects.
  */
diff --git a/chromium/v8/include/cppgc/cross-thread-persistent.h b/chromium/v8/include/cppgc/cross-thread-persistent.h
index fe61e9acbc3..0a9afdcd2bd 100644
--- a/chromium/v8/include/cppgc/cross-thread-persistent.h
+++ b/chromium/v8/include/cppgc/cross-thread-persistent.h
@@ -13,12 +13,34 @@
 #include "cppgc/visitor.h"
 
 namespace cppgc {
-
 namespace internal {
 
+// Wrapper around PersistentBase that allows accessing poisoned memory when
+// using ASAN. This is needed as the GC of the heap that owns the value
+// of a CTP, may clear it (heap termination, weakness) while the object
+// holding the CTP may be poisoned as itself may be deemed dead.
+class CrossThreadPersistentBase : public PersistentBase {
+ public:
+  CrossThreadPersistentBase() = default;
+  explicit CrossThreadPersistentBase(const void* raw) : PersistentBase(raw) {}
+
+  V8_CLANG_NO_SANITIZE("address") const void* GetValueFromGC() const {
+    return raw_;
+  }
+
+  V8_CLANG_NO_SANITIZE("address")
+  PersistentNode* GetNodeFromGC() const { return node_; }
+
+  V8_CLANG_NO_SANITIZE("address")
+  void ClearFromGC() const {
+    raw_ = nullptr;
+    node_ = nullptr;
+  }
+};
+
 template <typename T, typename WeaknessPolicy, typename LocationPolicy,
           typename CheckingPolicy>
-class BasicCrossThreadPersistent final : public PersistentBase,
+class BasicCrossThreadPersistent final : public CrossThreadPersistentBase,
                                          public LocationPolicy,
                                          private WeaknessPolicy,
                                          private CheckingPolicy {
@@ -38,11 +60,11 @@ class BasicCrossThreadPersistent final : public PersistentBase,
 
   BasicCrossThreadPersistent(
       SentinelPointer s, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(s), LocationPolicy(loc) {}
+      : CrossThreadPersistentBase(s), LocationPolicy(loc) {}
 
   BasicCrossThreadPersistent(
       T* raw, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(raw), LocationPolicy(loc) {
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
     if (!IsValid(raw)) return;
     PersistentRegionLock guard;
     CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
@@ -61,7 +83,7 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   BasicCrossThreadPersistent(
       UnsafeCtorTag, T* raw,
       const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(raw), LocationPolicy(loc) {
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
     if (!IsValid(raw)) return;
     CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
     SetNode(region.AllocateNode(this, &Trace));
@@ -329,12 +351,19 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   }
 
   void ClearFromGC() const {
-    if (IsValid(GetValue())) {
-      WeaknessPolicy::GetPersistentRegion(GetValue()).FreeNode(GetNode());
-      PersistentBase::ClearFromGC();
+    if (IsValid(GetValueFromGC())) {
+      WeaknessPolicy::GetPersistentRegion(GetValueFromGC())
+          .FreeNode(GetNodeFromGC());
+      CrossThreadPersistentBase::ClearFromGC();
     }
   }
 
+  // See Get() for details.
+  V8_CLANG_NO_SANITIZE("cfi-unrelated-cast")
+  T* GetFromGC() const {
+    return static_cast<T*>(const_cast<void*>(GetValueFromGC()));
+  }
+
   friend class cppgc::Visitor;
 };
 
diff --git a/chromium/v8/include/cppgc/heap-consistency.h b/chromium/v8/include/cppgc/heap-consistency.h
index 47caea18470..8e603d5d8af 100644
--- a/chromium/v8/include/cppgc/heap-consistency.h
+++ b/chromium/v8/include/cppgc/heap-consistency.h
@@ -69,6 +69,23 @@ class HeapConsistency final {
   }
 
   /**
+   * Gets the required write barrier type for a specific write.
+   * This version is meant to be used in conjunction with with a marking write
+   * barrier barrier which doesn't consider the slot.
+   *
+   * \param value The pointer to the object. May be an interior pointer to an
+   *   interface of the actual object.
+   * \param params Parameters that may be used for actual write barrier calls.
+   *   Only filled if return value indicates that a write barrier is needed. The
+   *   contents of the `params` are an implementation detail.
+   * \returns whether a write barrier is needed and which barrier to invoke.
+   */
+  static V8_INLINE WriteBarrierType
+  GetWriteBarrierType(const void* value, WriteBarrierParams& params) {
+    return internal::WriteBarrier::GetWriteBarrierType(value, params);
+  }
+
+  /**
    * Conservative Dijkstra-style write barrier that processes an object if it
    * has not yet been processed.
    *
diff --git a/chromium/v8/include/cppgc/heap-statistics.h b/chromium/v8/include/cppgc/heap-statistics.h
index 2fe6e1ae58a..8e626596e5b 100644
--- a/chromium/v8/include/cppgc/heap-statistics.h
+++ b/chromium/v8/include/cppgc/heap-statistics.h
@@ -5,7 +5,8 @@
 #ifndef INCLUDE_CPPGC_HEAP_STATISTICS_H_
 #define INCLUDE_CPPGC_HEAP_STATISTICS_H_
 
-#include <memory>
+#include <cstddef>
+#include <cstdint>
 #include <string>
 #include <vector>
 
@@ -30,19 +31,17 @@ struct HeapStatistics final {
   };
 
   /**
-   * Statistics of object types. For each type the statistics record its name,
-   * how many objects of that type were allocated, and the overall size used by
-   * these objects.
+   * Object statistics for a single type.
    */
-  struct ObjectStatistics {
-    /** Number of distinct types in the heap. */
-    size_t num_types = 0;
-    /** Name of each type in the heap. */
-    std::vector<std::string> type_name;
-    /** Number of allocated objects per each type. */
-    std::vector<size_t> type_count;
-    /** Overall size of allocated objects per each type. */
-    std::vector<size_t> type_bytes;
+  struct ObjectStatsEntry {
+    /**
+     * Number of allocated bytes.
+     */
+    size_t allocated_bytes;
+    /**
+     * Number of allocated objects.
+     */
+    size_t object_count;
   };
 
   /**
@@ -50,10 +49,15 @@ struct HeapStatistics final {
    * allocated memory size and overall used memory size for the page.
    */
   struct PageStatistics {
-    /** Overall amount of memory allocated for the page. */
-    size_t physical_size_bytes = 0;
+    /** Overall committed amount of memory for the page. */
+    size_t committed_size_bytes = 0;
+    /** Resident amount of memory held by the page. */
+    size_t resident_size_bytes = 0;
     /** Amount of memory actually used on the page. */
     size_t used_size_bytes = 0;
+    /** Statistics for object allocated on the page. Filled only when
+     * NameProvider::HideInternalNames() is false. */
+    std::vector<ObjectStatsEntry> object_statistics;
   };
 
   /**
@@ -80,29 +84,35 @@ struct HeapStatistics final {
   struct SpaceStatistics {
     /** The space name */
     std::string name;
-    /** Overall amount of memory allocated for the space. */
-    size_t physical_size_bytes = 0;
+    /** Overall committed amount of memory for the heap. */
+    size_t committed_size_bytes = 0;
+    /** Resident amount of memory held by the heap. */
+    size_t resident_size_bytes = 0;
     /** Amount of memory actually used on the space. */
     size_t used_size_bytes = 0;
     /** Statistics for each of the pages in the space. */
     std::vector<PageStatistics> page_stats;
     /** Statistics for the freelist of the space. */
     FreeListStatistics free_list_stats;
-    /** Statistics for object allocated on the space. Filled only when
-     * NameProvider::HideInternalNames() is false. */
-    ObjectStatistics object_stats;
   };
 
-  /** Overall amount of memory allocated for the heap. */
-  size_t physical_size_bytes = 0;
+  /** Overall committed amount of memory for the heap. */
+  size_t committed_size_bytes = 0;
+  /** Resident amount of memory help by the heap. */
+  size_t resident_size_bytes = 0;
   /** Amount of memory actually used on the heap. */
   size_t used_size_bytes = 0;
   /** Detail level of this HeapStatistics. */
   DetailLevel detail_level;
 
   /** Statistics for each of the spaces in the heap. Filled only when
-   * detail_level is kDetailed. */
+   * `detail_level` is `DetailLevel::kDetailed`. */
   std::vector<SpaceStatistics> space_stats;
+
+  /**
+   * Vector of `cppgc::GarbageCollected` type names.
+   */
+  std::vector<std::string> type_names;
 };
 
 }  // namespace cppgc
diff --git a/chromium/v8/include/cppgc/heap.h b/chromium/v8/include/cppgc/heap.h
index fd0512f1f18..136c4fb44d0 100644
--- a/chromium/v8/include/cppgc/heap.h
+++ b/chromium/v8/include/cppgc/heap.h
@@ -5,6 +5,8 @@
 #ifndef INCLUDE_CPPGC_HEAP_H_
 #define INCLUDE_CPPGC_HEAP_H_
 
+#include <cstddef>
+#include <cstdint>
 #include <memory>
 #include <vector>
 
diff --git a/chromium/v8/include/cppgc/internal/api-constants.h b/chromium/v8/include/cppgc/internal/api-constants.h
index a70f00710c8..7253a470893 100644
--- a/chromium/v8/include/cppgc/internal/api-constants.h
+++ b/chromium/v8/include/cppgc/internal/api-constants.h
@@ -5,8 +5,8 @@
 #ifndef INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
 #define INCLUDE_CPPGC_INTERNAL_API_CONSTANTS_H_
 
-#include <stddef.h>
-#include <stdint.h>
+#include <cstddef>
+#include <cstdint>
 
 #include "v8config.h"  // NOLINT(build/include_directory)
 
diff --git a/chromium/v8/include/cppgc/internal/gc-info.h b/chromium/v8/include/cppgc/internal/gc-info.h
index b9074b1ad5d..0830b194909 100644
--- a/chromium/v8/include/cppgc/internal/gc-info.h
+++ b/chromium/v8/include/cppgc/internal/gc-info.h
@@ -7,6 +7,7 @@
 
 #include <atomic>
 #include <cstdint>
+#include <type_traits>
 
 #include "cppgc/internal/finalizer-trait.h"
 #include "cppgc/internal/name-trait.h"
diff --git a/chromium/v8/include/cppgc/internal/name-trait.h b/chromium/v8/include/cppgc/internal/name-trait.h
index ae99d41c0d7..2e2da1eab4a 100644
--- a/chromium/v8/include/cppgc/internal/name-trait.h
+++ b/chromium/v8/include/cppgc/internal/name-trait.h
@@ -73,7 +73,7 @@ class NameTrait final : public NameTraitBase {
 
  private:
   static HeapObjectName GetNameFor(const NameProvider* name_provider) {
-    return {name_provider->GetName(), false};
+    return {name_provider->GetHumanReadableName(), false};
   }
 
   static HeapObjectName GetNameFor(...) {
@@ -91,7 +91,7 @@ class NameTrait final : public NameTraitBase {
 
     static const HeapObjectName leaky_name =
         GetNameFromTypeSignature(PRETTY_FUNCTION_VALUE);
-    return leaky_name;
+    return {leaky_name, false};
 
 #undef PRETTY_FUNCTION_VALUE
 
diff --git a/chromium/v8/include/cppgc/internal/persistent-node.h b/chromium/v8/include/cppgc/internal/persistent-node.h
index 5626b17820b..b5dba476a47 100644
--- a/chromium/v8/include/cppgc/internal/persistent-node.h
+++ b/chromium/v8/include/cppgc/internal/persistent-node.h
@@ -75,7 +75,7 @@ class PersistentNode final {
   TraceCallback trace_ = nullptr;
 };
 
-class V8_EXPORT PersistentRegion final {
+class V8_EXPORT PersistentRegion {
   using PersistentNodeSlots = std::array<PersistentNode, 256u>;
 
  public:
@@ -116,6 +116,9 @@ class V8_EXPORT PersistentRegion final {
  private:
   void EnsureNodeSlots();
 
+  template <typename PersistentBaseClass>
+  void ClearAllUsedNodes();
+
   std::vector<std::unique_ptr<PersistentNodeSlots>> nodes_;
   PersistentNode* free_list_head_ = nullptr;
   size_t nodes_in_use_ = 0;
@@ -135,7 +138,7 @@ class V8_EXPORT PersistentRegionLock final {
 
 // Variant of PersistentRegion that checks whether the PersistentRegionLock is
 // locked.
-class V8_EXPORT CrossThreadPersistentRegion final {
+class V8_EXPORT CrossThreadPersistentRegion final : protected PersistentRegion {
  public:
   CrossThreadPersistentRegion() = default;
   // Clears Persistent fields to avoid stale pointers after heap teardown.
@@ -147,12 +150,12 @@ class V8_EXPORT CrossThreadPersistentRegion final {
 
   V8_INLINE PersistentNode* AllocateNode(void* owner, TraceCallback trace) {
     PersistentRegionLock::AssertLocked();
-    return persistent_region_.AllocateNode(owner, trace);
+    return PersistentRegion::AllocateNode(owner, trace);
   }
 
   V8_INLINE void FreeNode(PersistentNode* node) {
     PersistentRegionLock::AssertLocked();
-    persistent_region_.FreeNode(node);
+    PersistentRegion::FreeNode(node);
   }
 
   void Trace(Visitor*);
@@ -160,9 +163,6 @@ class V8_EXPORT CrossThreadPersistentRegion final {
   size_t NodesInUse() const;
 
   void ClearAllUsedNodes();
-
- private:
-  PersistentRegion persistent_region_;
 };
 
 }  // namespace internal
diff --git a/chromium/v8/include/cppgc/internal/pointer-policies.h b/chromium/v8/include/cppgc/internal/pointer-policies.h
index e09b86199f4..cdf0bb693d6 100644
--- a/chromium/v8/include/cppgc/internal/pointer-policies.h
+++ b/chromium/v8/include/cppgc/internal/pointer-policies.h
@@ -82,7 +82,7 @@ class V8_EXPORT EnabledCheckingPolicy {
 
 class DisabledCheckingPolicy {
  protected:
-  void CheckPointer(const void* raw) {}
+  void CheckPointer(const void*) {}
 };
 
 #if V8_ENABLE_CHECKS
@@ -92,6 +92,10 @@ using DefaultPersistentCheckingPolicy = EnabledCheckingPolicy;
 using DefaultMemberCheckingPolicy = DisabledCheckingPolicy;
 using DefaultPersistentCheckingPolicy = DisabledCheckingPolicy;
 #endif
+// For CT(W)P neither marking information (for value), nor objectstart bitmap
+// (for slot) are guaranteed to be present because there's no synchonization
+// between heaps after marking.
+using DefaultCrossThreadPersistentCheckingPolicy = DisabledCheckingPolicy;
 
 class KeepLocationPolicy {
  public:
@@ -154,7 +158,7 @@ struct WeakCrossThreadPersistentPolicy {
 // Forward declarations setting up the default policies.
 template <typename T, typename WeaknessPolicy,
           typename LocationPolicy = DefaultLocationPolicy,
-          typename CheckingPolicy = DisabledCheckingPolicy>
+          typename CheckingPolicy = DefaultCrossThreadPersistentCheckingPolicy>
 class BasicCrossThreadPersistent;
 template <typename T, typename WeaknessPolicy,
           typename LocationPolicy = DefaultLocationPolicy,
diff --git a/chromium/v8/include/cppgc/internal/write-barrier.h b/chromium/v8/include/cppgc/internal/write-barrier.h
index f3aaedb1b83..28184dc9c83 100644
--- a/chromium/v8/include/cppgc/internal/write-barrier.h
+++ b/chromium/v8/include/cppgc/internal/write-barrier.h
@@ -5,9 +5,13 @@
 #ifndef INCLUDE_CPPGC_INTERNAL_WRITE_BARRIER_H_
 #define INCLUDE_CPPGC_INTERNAL_WRITE_BARRIER_H_
 
+#include <cstddef>
+#include <cstdint>
+
 #include "cppgc/heap-state.h"
 #include "cppgc/internal/api-constants.h"
 #include "cppgc/internal/atomic-entry-flag.h"
+#include "cppgc/platform.h"
 #include "cppgc/sentinel-pointer.h"
 #include "cppgc/trace-trait.h"
 #include "v8config.h"  // NOLINT(build/include_directory)
@@ -22,8 +26,11 @@ class HeapHandle;
 
 namespace internal {
 
+#if defined(CPPGC_CAGED_HEAP)
 class WriteBarrierTypeForCagedHeapPolicy;
+#else   // !CPPGC_CAGED_HEAP
 class WriteBarrierTypeForNonCagedHeapPolicy;
+#endif  // !CPPGC_CAGED_HEAP
 
 class V8_EXPORT WriteBarrier final {
  public:
@@ -60,6 +67,8 @@ class V8_EXPORT WriteBarrier final {
   template <typename HeapHandleCallback>
   static V8_INLINE Type GetWriteBarrierType(const void* slot, Params& params,
                                             HeapHandleCallback callback);
+  // Returns the required write barrier for a given  `value`.
+  static V8_INLINE Type GetWriteBarrierType(const void* value, Params& params);
 
   template <typename HeapHandleCallback>
   static V8_INLINE Type GetWriteBarrierTypeForExternallyReferencedObject(
@@ -141,9 +150,27 @@ class V8_EXPORT WriteBarrierTypeForCagedHeapPolicy final {
     return ValueModeDispatch<value_mode>::Get(slot, value, params, callback);
   }
 
+  template <WriteBarrier::ValueMode value_mode, typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type Get(const void* value,
+                                          WriteBarrier::Params& params,
+                                          HeapHandleCallback callback) {
+    return GetNoSlot(value, params, callback);
+  }
+
   template <typename HeapHandleCallback>
   static V8_INLINE WriteBarrier::Type GetForExternallyReferenced(
-      const void* value, WriteBarrier::Params& params, HeapHandleCallback) {
+      const void* value, WriteBarrier::Params& params,
+      HeapHandleCallback callback) {
+    return GetNoSlot(value, params, callback);
+  }
+
+ private:
+  WriteBarrierTypeForCagedHeapPolicy() = delete;
+
+  template <typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type GetNoSlot(const void* value,
+                                                WriteBarrier::Params& params,
+                                                HeapHandleCallback) {
     if (!TryGetCagedHeap(value, value, params)) {
       return WriteBarrier::Type::kNone;
     }
@@ -153,14 +180,14 @@ class V8_EXPORT WriteBarrierTypeForCagedHeapPolicy final {
     return SetAndReturnType<WriteBarrier::Type::kNone>(params);
   }
 
- private:
-  WriteBarrierTypeForCagedHeapPolicy() = delete;
-
   template <WriteBarrier::ValueMode value_mode>
   struct ValueModeDispatch;
 
   static V8_INLINE bool TryGetCagedHeap(const void* slot, const void* value,
                                         WriteBarrier::Params& params) {
+    // TODO(chromium:1056170): Check if the null check can be folded in with
+    // the rest of the write barrier.
+    if (!value) return false;
     params.start = reinterpret_cast<uintptr_t>(value) &
                    ~(api_constants::kCagedHeapReservationAlignment - 1);
     const uintptr_t slot_offset =
@@ -251,6 +278,15 @@ class V8_EXPORT WriteBarrierTypeForNonCagedHeapPolicy final {
     return ValueModeDispatch<value_mode>::Get(slot, value, params, callback);
   }
 
+  template <WriteBarrier::ValueMode value_mode, typename HeapHandleCallback>
+  static V8_INLINE WriteBarrier::Type Get(const void* value,
+                                          WriteBarrier::Params& params,
+                                          HeapHandleCallback callback) {
+    // The slot will never be used in `Get()` below.
+    return Get<WriteBarrier::ValueMode::kValuePresent>(nullptr, value, params,
+                                                       callback);
+  }
+
   template <typename HeapHandleCallback>
   static V8_INLINE WriteBarrier::Type GetForExternallyReferenced(
       const void* value, WriteBarrier::Params& params,
@@ -325,6 +361,13 @@ WriteBarrier::Type WriteBarrier::GetWriteBarrierType(
 }
 
 // static
+WriteBarrier::Type WriteBarrier::GetWriteBarrierType(
+    const void* value, WriteBarrier::Params& params) {
+  return WriteBarrierTypePolicy::Get<ValueMode::kValuePresent>(value, params,
+                                                               []() {});
+}
+
+// static
 template <typename HeapHandleCallback>
 WriteBarrier::Type
 WriteBarrier::GetWriteBarrierTypeForExternallyReferencedObject(
diff --git a/chromium/v8/include/cppgc/liveness-broker.h b/chromium/v8/include/cppgc/liveness-broker.h
index e449091280d..c94eef0d4ac 100644
--- a/chromium/v8/include/cppgc/liveness-broker.h
+++ b/chromium/v8/include/cppgc/liveness-broker.h
@@ -44,7 +44,10 @@ class V8_EXPORT LivenessBroker final {
  public:
   template <typename T>
   bool IsHeapObjectAlive(const T* object) const {
-    return object &&
+    // nullptr objects are considered alive to allow weakness to be used from
+    // stack while running into a conservative GC. Treating nullptr as dead
+    // would mean that e.g. custom collectins could not be strongified on stack.
+    return !object ||
            IsHeapObjectAliveImpl(
                TraceTrait<T>::GetTraceDescriptor(object).base_object_payload);
   }
diff --git a/chromium/v8/include/cppgc/macros.h b/chromium/v8/include/cppgc/macros.h
index 70ab44c6575..030f397e3df 100644
--- a/chromium/v8/include/cppgc/macros.h
+++ b/chromium/v8/include/cppgc/macros.h
@@ -5,7 +5,7 @@
 #ifndef INCLUDE_CPPGC_MACROS_H_
 #define INCLUDE_CPPGC_MACROS_H_
 
-#include <stddef.h>
+#include <cstddef>
 
 #include "cppgc/internal/compiler-specific.h"
 
diff --git a/chromium/v8/include/cppgc/member.h b/chromium/v8/include/cppgc/member.h
index 16aed060226..38105b8e432 100644
--- a/chromium/v8/include/cppgc/member.h
+++ b/chromium/v8/include/cppgc/member.h
@@ -218,6 +218,8 @@ class BasicMember final : private MemberBase, private CheckingPolicy {
 
   void ClearFromGC() const { MemberBase::ClearFromGC(); }
 
+  T* GetFromGC() const { return Get(); }
+
   friend class cppgc::Visitor;
   template <typename U>
   friend struct cppgc::TraceTrait;
@@ -226,20 +228,20 @@ class BasicMember final : private MemberBase, private CheckingPolicy {
 template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
           typename CheckingPolicy1, typename T2, typename WeaknessTag2,
           typename WriteBarrierPolicy2, typename CheckingPolicy2>
-bool operator==(
-    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
-    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
-        member2) {
+bool operator==(const BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1,
+                                  CheckingPolicy1>& member1,
+                const BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2,
+                                  CheckingPolicy2>& member2) {
   return member1.Get() == member2.Get();
 }
 
 template <typename T1, typename WeaknessTag1, typename WriteBarrierPolicy1,
           typename CheckingPolicy1, typename T2, typename WeaknessTag2,
           typename WriteBarrierPolicy2, typename CheckingPolicy2>
-bool operator!=(
-    BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1, CheckingPolicy1> member1,
-    BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2, CheckingPolicy2>
-        member2) {
+bool operator!=(const BasicMember<T1, WeaknessTag1, WriteBarrierPolicy1,
+                                  CheckingPolicy1>& member1,
+                const BasicMember<T2, WeaknessTag2, WriteBarrierPolicy2,
+                                  CheckingPolicy2>& member2) {
   return !(member1 == member2);
 }
 
diff --git a/chromium/v8/include/cppgc/name-provider.h b/chromium/v8/include/cppgc/name-provider.h
index 8b70b8ea5ee..224dd4b5d67 100644
--- a/chromium/v8/include/cppgc/name-provider.h
+++ b/chromium/v8/include/cppgc/name-provider.h
@@ -57,7 +57,7 @@ class V8_EXPORT NameProvider {
    *
    * @returns a human readable name for the object.
    */
-  virtual const char* GetName() const = 0;
+  virtual const char* GetHumanReadableName() const = 0;
 };
 
 }  // namespace cppgc
diff --git a/chromium/v8/include/cppgc/persistent.h b/chromium/v8/include/cppgc/persistent.h
index 22cda7c6e8f..b83a464576e 100644
--- a/chromium/v8/include/cppgc/persistent.h
+++ b/chromium/v8/include/cppgc/persistent.h
@@ -41,7 +41,7 @@ class PersistentBase {
     node_ = nullptr;
   }
 
- private:
+ protected:
   mutable const void* raw_ = nullptr;
   mutable PersistentNode* node_ = nullptr;
 
@@ -141,7 +141,7 @@ class BasicPersistent final : public PersistentBase,
   }
 
   // Move assignment.
-  BasicPersistent& operator=(BasicPersistent&& other) {
+  BasicPersistent& operator=(BasicPersistent&& other) noexcept {
     if (this == &other) return *this;
     Clear();
     PersistentBase::operator=(std::move(other));
@@ -259,6 +259,12 @@ class BasicPersistent final : public PersistentBase,
     }
   }
 
+  // Set Get() for details.
+  V8_CLANG_NO_SANITIZE("cfi-unrelated-cast")
+  T* GetFromGC() const {
+    return static_cast<T*>(const_cast<void*>(GetValue()));
+  }
+
   friend class cppgc::Visitor;
 };
 
diff --git a/chromium/v8/include/cppgc/platform.h b/chromium/v8/include/cppgc/platform.h
index 0d7377668cf..3276a26b652 100644
--- a/chromium/v8/include/cppgc/platform.h
+++ b/chromium/v8/include/cppgc/platform.h
@@ -5,6 +5,8 @@
 #ifndef INCLUDE_CPPGC_PLATFORM_H_
 #define INCLUDE_CPPGC_PLATFORM_H_
 
+#include <memory>
+
 #include "v8-platform.h"  // NOLINT(build/include_directory)
 #include "v8config.h"     // NOLINT(build/include_directory)
 
@@ -146,6 +148,7 @@ namespace internal {
 V8_EXPORT void Abort();
 
 }  // namespace internal
+
 }  // namespace cppgc
 
 #endif  // INCLUDE_CPPGC_PLATFORM_H_
diff --git a/chromium/v8/include/cppgc/source-location.h b/chromium/v8/include/cppgc/source-location.h
index 29d69b0a137..da5a5ede520 100644
--- a/chromium/v8/include/cppgc/source-location.h
+++ b/chromium/v8/include/cppgc/source-location.h
@@ -5,6 +5,7 @@
 #ifndef INCLUDE_CPPGC_SOURCE_LOCATION_H_
 #define INCLUDE_CPPGC_SOURCE_LOCATION_H_
 
+#include <cstddef>
 #include <string>
 
 #include "v8config.h"  // NOLINT(build/include_directory)
diff --git a/chromium/v8/include/cppgc/visitor.h b/chromium/v8/include/cppgc/visitor.h
index 98de9957bd6..57e2ce3963a 100644
--- a/chromium/v8/include/cppgc/visitor.h
+++ b/chromium/v8/include/cppgc/visitor.h
@@ -12,6 +12,7 @@
 #include "cppgc/internal/pointer-policies.h"
 #include "cppgc/liveness-broker.h"
 #include "cppgc/member.h"
+#include "cppgc/sentinel-pointer.h"
 #include "cppgc/source-location.h"
 #include "cppgc/trace-trait.h"
 #include "cppgc/type-traits.h"
@@ -318,10 +319,10 @@ class V8_EXPORT Visitor {
   template <typename PointerType>
   static void HandleWeak(const LivenessBroker& info, const void* object) {
     const PointerType* weak = static_cast<const PointerType*>(object);
+    auto* raw_ptr = weak->GetFromGC();
     // Sentinel values are preserved for weak pointers.
-    if (*weak == kSentinelPointer) return;
-    const auto* raw = weak->Get();
-    if (!info.IsHeapObjectAlive(raw)) {
+    if (raw_ptr == kSentinelPointer) return;
+    if (!info.IsHeapObjectAlive(raw_ptr)) {
       weak->ClearFromGC();
     }
   }
@@ -335,11 +336,11 @@ class V8_EXPORT Visitor {
     static_assert(internal::IsGarbageCollectedOrMixinType<PointeeType>::value,
                   "Persistent's pointee type must be GarbageCollected or "
                   "GarbageCollectedMixin");
-    if (!p.Get()) {
+    auto* ptr = p.GetFromGC();
+    if (!ptr) {
       return;
     }
-    VisitRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()),
-              loc);
+    VisitRoot(ptr, TraceTrait<PointeeType>::GetTraceDescriptor(ptr), loc);
   }
 
   template <
@@ -354,7 +355,8 @@ class V8_EXPORT Visitor {
                   "GarbageCollectedMixin");
     static_assert(!internal::IsAllocatedOnCompactableSpace<PointeeType>::value,
                   "Weak references to compactable objects are not allowed");
-    VisitWeakRoot(p.Get(), TraceTrait<PointeeType>::GetTraceDescriptor(p.Get()),
+    auto* ptr = p.GetFromGC();
+    VisitWeakRoot(ptr, TraceTrait<PointeeType>::GetTraceDescriptor(ptr),
                   &HandleWeak<WeakPersistent>, &p, loc);
   }
 
diff --git a/chromium/v8/include/js_protocol.pdl b/chromium/v8/include/js_protocol.pdl
index 9c0483ae705..ebf9eb7fe82 100644
--- a/chromium/v8/include/js_protocol.pdl
+++ b/chromium/v8/include/js_protocol.pdl
@@ -175,7 +175,7 @@ domain Debugger
   command enable
     parameters
       # The maximum size in bytes of collected scripts (not referenced by other heap objects)
-      # the debugger can hold. Puts no limit if paramter is omitted.
+      # the debugger can hold. Puts no limit if parameter is omitted.
       experimental optional number maxScriptsCacheSize
     returns
       # Unique identifier of the debugger.
@@ -714,7 +714,7 @@ experimental domain HeapProfiler
     parameters
       # If true 'reportHeapSnapshotProgress' events will be generated while snapshot is being taken.
       optional boolean reportProgress
-      # If true, a raw snapshot without artifical roots will be generated
+      # If true, a raw snapshot without artificial roots will be generated
       optional boolean treatGlobalObjectsAsRoots
       # If true, numerical values are included in the snapshot
       optional boolean captureNumericValue
@@ -972,13 +972,13 @@ domain Profiler
   # Reports coverage delta since the last poll (either from an event like this, or from
   # `takePreciseCoverage` for the current isolate. May only be sent if precise code
   # coverage has been started. This event can be trigged by the embedder to, for example,
-  # trigger collection of coverage data immediatelly at a certain point in time.
+  # trigger collection of coverage data immediately at a certain point in time.
   experimental event preciseCoverageDeltaUpdate
     parameters
       # Monotonically increasing time (in seconds) when the coverage update was taken in the backend.
       number timestamp
       # Identifier for distinguishing coverage events.
-      string occassion
+      string occasion
       # Coverage data for the current isolate.
       array of ScriptCoverage result
 
@@ -1225,7 +1225,7 @@ domain Runtime
       string origin
       # Human readable name describing given context.
       string name
-      # A system-unique execution context identifier. Unlike the id, this is unique accross
+      # A system-unique execution context identifier. Unlike the id, this is unique across
       # multiple processes, so can be reliably used to identify specific context while backend
       # performs a cross-process navigation.
       experimental string uniqueId
@@ -1254,6 +1254,10 @@ domain Runtime
       optional RemoteObject exception
       # Identifier of the context where exception happened.
       optional ExecutionContextId executionContextId
+      # Dictionary with entries of meta data that the client associated
+      # with this exception, such as information about associated network
+      # requests, etc.
+      experimental optional object exceptionMetaData
 
   # Number of milliseconds since epoch.
   type Timestamp extends number
@@ -1343,6 +1347,8 @@ domain Runtime
       # Symbolic group name that can be used to release multiple objects. If objectGroup is not
       # specified and objectId is, objectGroup will be inherited from object.
       optional string objectGroup
+      # Whether to throw an exception if side effect cannot be ruled out during evaluation.
+      experimental optional boolean throwOnSideEffect
     returns
       # Call result.
       RemoteObject result
@@ -1422,9 +1428,9 @@ domain Runtime
       # evaluation and allows unsafe-eval. Defaults to true.
       experimental optional boolean allowUnsafeEvalBlockedByCSP
       # An alternative way to specify the execution context to evaluate in.
-      # Compared to contextId that may be reused accross processes, this is guaranteed to be
+      # Compared to contextId that may be reused across processes, this is guaranteed to be
       # system-unique, so it can be used to prevent accidental evaluation of the expression
-      # in context different than intended (e.g. as a result of navigation accross process
+      # in context different than intended (e.g. as a result of navigation across process
       # boundaries).
       # This is mutually exclusive with `contextId`.
       experimental optional string uniqueContextId
@@ -1666,6 +1672,8 @@ domain Runtime
     parameters
       RemoteObject object
       object hints
+      # Identifier of the context where the call was made.
+      experimental optional ExecutionContextId executionContextId
 
 # This domain is deprecated.
 deprecated domain Schema
diff --git a/chromium/v8/include/v8-fast-api-calls.h b/chromium/v8/include/v8-fast-api-calls.h
index cdf67decf67..8c9d02769ee 100644
--- a/chromium/v8/include/v8-fast-api-calls.h
+++ b/chromium/v8/include/v8-fast-api-calls.h
@@ -156,6 +156,7 @@
  *   - float64_t
  * Currently supported argument types:
  *  - pointer to an embedder type
+ *  - JavaScript array of primitive types
  *  - bool
  *  - int32_t
  *  - uint32_t
@@ -176,8 +177,43 @@
  * passes NaN values as-is, i.e. doesn't normalize them.
  *
  * To be supported types:
- *  - arrays of C types
+ *  - TypedArrays and ArrayBuffers
  *  - arrays of embedder types
+ *
+ *
+ * The API offers a limited support for function overloads:
+ *
+ * \code
+ *    void FastMethod_2Args(int param, bool another_param);
+ *    void FastMethod_3Args(int param, bool another_param, int third_param);
+ *
+ *    v8::CFunction fast_method_2args_c_func =
+ *         MakeV8CFunction(FastMethod_2Args);
+ *    v8::CFunction fast_method_3args_c_func =
+ *         MakeV8CFunction(FastMethod_3Args);
+ *    const v8::CFunction fast_method_overloads[] = {fast_method_2args_c_func,
+ *                                                   fast_method_3args_c_func};
+ *    Local<v8::FunctionTemplate> method_template =
+ *        v8::FunctionTemplate::NewWithCFunctionOverloads(
+ *            isolate, SlowCallback, data, signature, length,
+ *            constructor_behavior, side_effect_type,
+ *            {fast_method_overloads, 2});
+ * \endcode
+ *
+ * In this example a single FunctionTemplate is associated to multiple C++
+ * functions. The overload resolution is currently only based on the number of
+ * arguments passed in a call. For example, if this method_template is
+ * registered with a wrapper JS object as described above, a call with two
+ * arguments:
+ *    obj.method(42, true);
+ * will result in a fast call to FastMethod_2Args, while a call with three or
+ * more arguments:
+ *    obj.method(42, true, 11);
+ * will result in a fast call to FastMethod_3Args. Instead a call with less than
+ * two arguments, like:
+ *    obj.method(42);
+ * would not result in a fast call but would fall back to executing the
+ * associated SlowCallback.
  */
 
 #ifndef INCLUDE_V8_FAST_API_CALLS_H_
@@ -189,8 +225,9 @@
 #include <tuple>
 #include <type_traits>
 
-#include "v8.h"        // NOLINT(build/include_directory)
-#include "v8config.h"  // NOLINT(build/include_directory)
+#include "v8-internal.h"  // NOLINT(build/include_directory)
+#include "v8.h"           // NOLINT(build/include_directory)
+#include "v8config.h"     // NOLINT(build/include_directory)
 
 namespace v8 {
 
@@ -217,22 +254,99 @@ class CTypeInfo {
   // than any valid Type enum.
   static constexpr Type kCallbackOptionsType = Type(255);
 
+  enum class SequenceType : uint8_t {
+    kScalar,
+    kIsSequence,    // sequence<T>
+    kIsTypedArray,  // TypedArray of T or any ArrayBufferView if T
+                    // is void
+    kIsArrayBuffer  // ArrayBuffer
+  };
+
   enum class Flags : uint8_t {
     kNone = 0,
+    kAllowSharedBit = 1 << 0,   // Must be an ArrayBuffer or TypedArray
+    kEnforceRangeBit = 1 << 1,  // T must be integral
+    kClampBit = 1 << 2,         // T must be integral
+    kIsRestrictedBit = 1 << 3,  // T must be float or double
   };
 
-  explicit constexpr CTypeInfo(Type type, Flags flags = Flags::kNone)
-      : type_(type), flags_(flags) {}
+  explicit constexpr CTypeInfo(
+      Type type, SequenceType sequence_type = SequenceType::kScalar,
+      Flags flags = Flags::kNone)
+      : type_(type), sequence_type_(sequence_type), flags_(flags) {}
 
   constexpr Type GetType() const { return type_; }
-
+  constexpr SequenceType GetSequenceType() const { return sequence_type_; }
   constexpr Flags GetFlags() const { return flags_; }
 
+  static constexpr bool IsIntegralType(Type type) {
+    return type == Type::kInt32 || type == Type::kUint32 ||
+           type == Type::kInt64 || type == Type::kUint64;
+  }
+
+  static constexpr bool IsFloatingPointType(Type type) {
+    return type == Type::kFloat32 || type == Type::kFloat64;
+  }
+
+  static constexpr bool IsPrimitive(Type type) {
+    return IsIntegralType(type) || IsFloatingPointType(type) ||
+           type == Type::kBool;
+  }
+
  private:
   Type type_;
+  SequenceType sequence_type_;
   Flags flags_;
 };
 
+struct FastApiTypedArrayBase {
+ public:
+  // Returns the length in number of elements.
+  size_t V8_EXPORT length() const { return length_; }
+  // Checks whether the given index is within the bounds of the collection.
+  void V8_EXPORT ValidateIndex(size_t index) const;
+
+ protected:
+  size_t length_ = 0;
+};
+
+template <typename T>
+struct FastApiTypedArray : public FastApiTypedArrayBase {
+ public:
+  V8_INLINE T get(size_t index) const {
+#ifdef DEBUG
+    ValidateIndex(index);
+#endif  // DEBUG
+    T tmp;
+    memcpy(&tmp, reinterpret_cast<T*>(data_) + index, sizeof(T));
+    return tmp;
+  }
+
+ private:
+  // This pointer should include the typed array offset applied.
+  // It's not guaranteed that it's aligned to sizeof(T), it's only
+  // guaranteed that it's 4-byte aligned, so for 8-byte types we need to
+  // provide a special implementation for reading from it, which hides
+  // the possibly unaligned read in the `get` method.
+  void* data_;
+};
+
+// Any TypedArray. It uses kTypedArrayBit with base type void
+// Overloaded args of ArrayBufferView and TypedArray are not supported
+// (for now) because the generic “any” ArrayBufferView doesn’t have its
+// own instance type. It could be supported if we specify that
+// TypedArray<T> always has precedence over the generic ArrayBufferView,
+// but this complicates overload resolution.
+struct FastApiArrayBufferView {
+  void* data;
+  size_t byte_length;
+};
+
+struct FastApiArrayBuffer {
+  void* data;
+  size_t byte_length;
+};
+
 class V8_EXPORT CFunctionInfo {
  public:
   // Construct a struct to hold a CFunction's type information.
@@ -284,6 +398,42 @@ class V8_EXPORT CFunction {
   const void* GetAddress() const { return address_; }
   const CFunctionInfo* GetTypeInfo() const { return type_info_; }
 
+  enum class OverloadResolution { kImpossible, kAtRuntime, kAtCompileTime };
+
+  // Returns whether an overload between this and the given CFunction can
+  // be resolved at runtime by the RTTI available for the arguments or at
+  // compile time for functions with different number of arguments.
+  OverloadResolution GetOverloadResolution(const CFunction* other) {
+    // Runtime overload resolution can only deal with functions with the
+    // same number of arguments. Functions with different arity are handled
+    // by compile time overload resolution though.
+    if (ArgumentCount() != other->ArgumentCount()) {
+      return OverloadResolution::kAtCompileTime;
+    }
+
+    // The functions can only differ by a single argument position.
+    int diff_index = -1;
+    for (unsigned int i = 0; i < ArgumentCount(); ++i) {
+      if (ArgumentInfo(i).GetSequenceType() !=
+          other->ArgumentInfo(i).GetSequenceType()) {
+        if (diff_index >= 0) {
+          return OverloadResolution::kImpossible;
+        }
+        diff_index = i;
+
+        // We only support overload resolution between sequence types.
+        if (ArgumentInfo(i).GetSequenceType() ==
+                CTypeInfo::SequenceType::kScalar ||
+            other->ArgumentInfo(i).GetSequenceType() ==
+                CTypeInfo::SequenceType::kScalar) {
+          return OverloadResolution::kImpossible;
+        }
+      }
+    }
+
+    return OverloadResolution::kAtRuntime;
+  }
+
   template <typename F>
   static CFunction Make(F* func) {
     return ArgUnwrap<F*>::Make(func);
@@ -412,28 +562,91 @@ struct TypeInfoHelper {
     }                                                                         \
                                                                               \
     static constexpr CTypeInfo::Type Type() { return CTypeInfo::Type::Enum; } \
+    static constexpr CTypeInfo::SequenceType SequenceType() {                 \
+      return CTypeInfo::SequenceType::kScalar;                                \
+    }                                                                         \
   };
 
-#define BASIC_C_TYPES(V)            \
-  V(void, kVoid)                    \
-  V(bool, kBool)                    \
-  V(int32_t, kInt32)                \
-  V(uint32_t, kUint32)              \
-  V(int64_t, kInt64)                \
-  V(uint64_t, kUint64)              \
-  V(float, kFloat32)                \
-  V(double, kFloat64)               \
-  V(ApiObject, kApiObject)          \
-  V(v8::Local<v8::Value>, kV8Value) \
-  V(v8::Local<v8::Object>, kV8Value)
+template <CTypeInfo::Type type>
+struct CTypeInfoTraits {};
+
+#define DEFINE_TYPE_INFO_TRAITS(CType, Enum)      \
+  template <>                                     \
+  struct CTypeInfoTraits<CTypeInfo::Type::Enum> { \
+    using ctype = CType;                          \
+  };
+
+#define PRIMITIVE_C_TYPES(V) \
+  V(bool, kBool)             \
+  V(int32_t, kInt32)         \
+  V(uint32_t, kUint32)       \
+  V(int64_t, kInt64)         \
+  V(uint64_t, kUint64)       \
+  V(float, kFloat32)         \
+  V(double, kFloat64)
+
+// Same as above, but includes deprecated types for compatibility.
+#define ALL_C_TYPES(V)               \
+  PRIMITIVE_C_TYPES(V)               \
+  V(void, kVoid)                     \
+  V(v8::Local<v8::Value>, kV8Value)  \
+  V(v8::Local<v8::Object>, kV8Value) \
+  V(ApiObject, kApiObject)
 
 // ApiObject was a temporary solution to wrap the pointer to the v8::Value.
 // Please use v8::Local<v8::Value> in new code for the arguments and
 // v8::Local<v8::Object> for the receiver, as ApiObject will be deprecated.
 
-BASIC_C_TYPES(SPECIALIZE_GET_TYPE_INFO_HELPER_FOR)
+ALL_C_TYPES(SPECIALIZE_GET_TYPE_INFO_HELPER_FOR)
+PRIMITIVE_C_TYPES(DEFINE_TYPE_INFO_TRAITS)
+
+#undef PRIMITIVE_C_TYPES
+#undef ALL_C_TYPES
 
-#undef BASIC_C_TYPES
+#define SPECIALIZE_GET_TYPE_INFO_HELPER_FOR_TA(T, Enum)                       \
+  template <>                                                                 \
+  struct TypeInfoHelper<const FastApiTypedArray<T>&> {                        \
+    static constexpr CTypeInfo::Flags Flags() {                               \
+      return CTypeInfo::Flags::kNone;                                         \
+    }                                                                         \
+                                                                              \
+    static constexpr CTypeInfo::Type Type() { return CTypeInfo::Type::Enum; } \
+    static constexpr CTypeInfo::SequenceType SequenceType() {                 \
+      return CTypeInfo::SequenceType::kIsTypedArray;                          \
+    }                                                                         \
+  };
+
+#define TYPED_ARRAY_C_TYPES(V) \
+  V(int32_t, kInt32)           \
+  V(uint32_t, kUint32)         \
+  V(int64_t, kInt64)           \
+  V(uint64_t, kUint64)         \
+  V(float, kFloat32)           \
+  V(double, kFloat64)
+
+TYPED_ARRAY_C_TYPES(SPECIALIZE_GET_TYPE_INFO_HELPER_FOR_TA)
+
+#undef TYPED_ARRAY_C_TYPES
+
+template <>
+struct TypeInfoHelper<v8::Local<v8::Array>> {
+  static constexpr CTypeInfo::Flags Flags() { return CTypeInfo::Flags::kNone; }
+
+  static constexpr CTypeInfo::Type Type() { return CTypeInfo::Type::kVoid; }
+  static constexpr CTypeInfo::SequenceType SequenceType() {
+    return CTypeInfo::SequenceType::kIsSequence;
+  }
+};
+
+template <>
+struct TypeInfoHelper<v8::Local<v8::Uint32Array>> {
+  static constexpr CTypeInfo::Flags Flags() { return CTypeInfo::Flags::kNone; }
+
+  static constexpr CTypeInfo::Type Type() { return CTypeInfo::Type::kUint32; }
+  static constexpr CTypeInfo::SequenceType SequenceType() {
+    return CTypeInfo::SequenceType::kIsTypedArray;
+  }
+};
 
 template <>
 struct TypeInfoHelper<FastApiCallbackOptions&> {
@@ -442,26 +655,63 @@ struct TypeInfoHelper<FastApiCallbackOptions&> {
   static constexpr CTypeInfo::Type Type() {
     return CTypeInfo::kCallbackOptionsType;
   }
+  static constexpr CTypeInfo::SequenceType SequenceType() {
+    return CTypeInfo::SequenceType::kScalar;
+  }
 };
 
+#define STATIC_ASSERT_IMPLIES(COND, ASSERTION, MSG) \
+  static_assert(((COND) == 0) || (ASSERTION), MSG)
+
 template <typename T, CTypeInfo::Flags... Flags>
 class CTypeInfoBuilder {
  public:
   using BaseType = T;
 
   static constexpr CTypeInfo Build() {
-    // Get the flags and merge in any additional flags.
-    uint8_t flags = uint8_t(TypeInfoHelper<T>::Flags());
-    int unused[] = {0, (flags |= uint8_t(Flags), 0)...};
-    // With C++17, we could use a "..." fold expression over a parameter pack.
-    // Since we're still using C++14, we have to evaluate an OR expresion while
-    // constructing an unused list of 0's. This applies the binary operator
-    // for each value in Flags.
-    (void)unused;
+    constexpr CTypeInfo::Flags kFlags =
+        MergeFlags(TypeInfoHelper<T>::Flags(), Flags...);
+    constexpr CTypeInfo::Type kType = TypeInfoHelper<T>::Type();
+    constexpr CTypeInfo::SequenceType kSequenceType =
+        TypeInfoHelper<T>::SequenceType();
+
+    STATIC_ASSERT_IMPLIES(
+        uint8_t(kFlags) & uint8_t(CTypeInfo::Flags::kAllowSharedBit),
+        (kSequenceType == CTypeInfo::SequenceType::kIsTypedArray ||
+         kSequenceType == CTypeInfo::SequenceType::kIsArrayBuffer),
+        "kAllowSharedBit is only allowed for TypedArrays and ArrayBuffers.");
+    STATIC_ASSERT_IMPLIES(
+        uint8_t(kFlags) & uint8_t(CTypeInfo::Flags::kEnforceRangeBit),
+        CTypeInfo::IsIntegralType(kType),
+        "kEnforceRangeBit is only allowed for integral types.");
+    STATIC_ASSERT_IMPLIES(
+        uint8_t(kFlags) & uint8_t(CTypeInfo::Flags::kClampBit),
+        CTypeInfo::IsIntegralType(kType),
+        "kClampBit is only allowed for integral types.");
+    STATIC_ASSERT_IMPLIES(
+        uint8_t(kFlags) & uint8_t(CTypeInfo::Flags::kIsRestrictedBit),
+        CTypeInfo::IsFloatingPointType(kType),
+        "kIsRestrictedBit is only allowed for floating point types.");
+    STATIC_ASSERT_IMPLIES(kSequenceType == CTypeInfo::SequenceType::kIsSequence,
+                          kType == CTypeInfo::Type::kVoid,
+                          "Sequences are only supported from void type.");
+    STATIC_ASSERT_IMPLIES(
+        kSequenceType == CTypeInfo::SequenceType::kIsTypedArray,
+        CTypeInfo::IsPrimitive(kType) || kType == CTypeInfo::Type::kVoid,
+        "TypedArrays are only supported from primitive types or void.");
 
     // Return the same type with the merged flags.
-    return CTypeInfo(TypeInfoHelper<T>::Type(), CTypeInfo::Flags(flags));
+    return CTypeInfo(TypeInfoHelper<T>::Type(),
+                     TypeInfoHelper<T>::SequenceType(), kFlags);
   }
+
+ private:
+  template <typename... Rest>
+  static constexpr CTypeInfo::Flags MergeFlags(CTypeInfo::Flags flags,
+                                               Rest... rest) {
+    return CTypeInfo::Flags(uint8_t(flags) | uint8_t(MergeFlags(rest...)));
+  }
+  static constexpr CTypeInfo::Flags MergeFlags() { return CTypeInfo::Flags(0); }
 };
 
 template <typename RetBuilder, typename... ArgBuilders>
@@ -513,8 +763,9 @@ class CFunctionBuilderWithFunction {
         Flags...>;
   };
 
-  // Return a copy of the CFunctionBuilder, but merges the Flags on ArgBuilder
-  // index N with the new Flags passed in the template parameter pack.
+  // Return a copy of the CFunctionBuilder, but merges the Flags on
+  // ArgBuilder index N with the new Flags passed in the template parameter
+  // pack.
   template <unsigned int N, CTypeInfo::Flags... Flags, size_t... I>
   constexpr auto ArgImpl(std::index_sequence<I...>) {
     return CFunctionBuilderWithFunction<
@@ -546,6 +797,40 @@ CFunction CFunction::ArgUnwrap<R (*)(Args...)>::Make(R (*func)(Args...)) {
 
 using CFunctionBuilder = internal::CFunctionBuilder;
 
+static constexpr CTypeInfo kTypeInfoInt32 = CTypeInfo(CTypeInfo::Type::kInt32);
+static constexpr CTypeInfo kTypeInfoFloat64 =
+    CTypeInfo(CTypeInfo::Type::kFloat64);
+
+/**
+ * Copies the contents of this JavaScript array to a C++ buffer with
+ * a given max_length. A CTypeInfo is passed as an argument,
+ * instructing different rules for conversion (e.g. restricted float/double).
+ * The element type T of the destination array must match the C type
+ * corresponding to the CTypeInfo (specified by CTypeInfoTraits).
+ * If the array length is larger than max_length or the array is of
+ * unsupported type, the operation will fail, returning false. Generally, an
+ * array which contains objects, undefined, null or anything not convertible
+ * to the requested destination type, is considered unsupported. The operation
+ * returns true on success. `type_info` will be used for conversions.
+ */
+template <const CTypeInfo* type_info, typename T>
+bool V8_EXPORT V8_WARN_UNUSED_RESULT TryCopyAndConvertArrayToCppBuffer(
+    Local<Array> src, T* dst, uint32_t max_length);
+
+template <>
+inline bool V8_WARN_UNUSED_RESULT
+TryCopyAndConvertArrayToCppBuffer<&kTypeInfoInt32, int32_t>(
+    Local<Array> src, int32_t* dst, uint32_t max_length) {
+  return CopyAndConvertArrayToCppBufferInt32(src, dst, max_length);
+}
+
+template <>
+inline bool V8_WARN_UNUSED_RESULT
+TryCopyAndConvertArrayToCppBuffer<&kTypeInfoFloat64, double>(
+    Local<Array> src, double* dst, uint32_t max_length) {
+  return CopyAndConvertArrayToCppBufferFloat64(src, dst, max_length);
+}
+
 }  // namespace v8
 
 #endif  // INCLUDE_V8_FAST_API_CALLS_H_
diff --git a/chromium/v8/include/v8-inspector.h b/chromium/v8/include/v8-inspector.h
index 852b39d7252..e6621ccd75c 100644
--- a/chromium/v8/include/v8-inspector.h
+++ b/chromium/v8/include/v8-inspector.h
@@ -170,7 +170,7 @@ class V8_EXPORT V8InspectorSession {
                             v8::Local<v8::Context>*,
                             std::unique_ptr<StringBuffer>* objectGroup) = 0;
   virtual void releaseObjectGroup(StringView) = 0;
-  virtual void triggerPreciseCoverageDeltaUpdate(StringView occassion) = 0;
+  virtual void triggerPreciseCoverageDeltaUpdate(StringView occasion) = 0;
 };
 
 class V8_EXPORT V8InspectorClient {
@@ -194,9 +194,6 @@ class V8_EXPORT V8InspectorClient {
       v8::Local<v8::Context>, v8::Local<v8::Value>) {
     return nullptr;
   }
-  virtual bool formatAccessorsAsProperties(v8::Local<v8::Value>) {
-    return false;
-  }
   virtual bool isInspectableHeapObject(v8::Local<v8::Object>) { return true; }
 
   virtual v8::Local<v8::Context> ensureDefaultContextInGroup(
@@ -301,6 +298,10 @@ class V8_EXPORT V8Inspector {
                                    int scriptId) = 0;
   virtual void exceptionRevoked(v8::Local<v8::Context>, unsigned exceptionId,
                                 StringView message) = 0;
+  virtual bool associateExceptionData(v8::Local<v8::Context>,
+                                      v8::Local<v8::Value> exception,
+                                      v8::Local<v8::Name> key,
+                                      v8::Local<v8::Value> value) = 0;
 
   // Connection.
   class V8_EXPORT Channel {
diff --git a/chromium/v8/include/v8-internal.h b/chromium/v8/include/v8-internal.h
index f289149d8d0..0222ab2f7e1 100644
--- a/chromium/v8/include/v8-internal.h
+++ b/chromium/v8/include/v8-internal.h
@@ -15,9 +15,12 @@
 
 namespace v8 {
 
+class Array;
 class Context;
 class Data;
 class Isolate;
+template <typename T>
+class Local;
 
 namespace internal {
 
@@ -146,6 +149,7 @@ enum ExternalPointerTag : uint64_t {
   kForeignForeignAddressTag = 0x01f7000000000000,        // 0b000000111110111
   kNativeContextMicrotaskQueueTag = 0x01fb000000000000,  // 0b000000111111011
   kEmbedderDataSlotPayloadTag = 0x01fd000000000000,      // 0b000000111111101
+  kCodeEntryPointTag = 0x01fe000000000000,               // 0b000000111111110
 };
 
 constexpr uint64_t kExternalPointerTagMask = 0xffff000000000000;
@@ -184,6 +188,8 @@ V8_EXPORT internal::Isolate* IsolateFromNeverReadOnlySpaceObject(Address obj);
 // language mode is strict.
 V8_EXPORT bool ShouldThrowOnError(v8::internal::Isolate* isolate);
 
+V8_EXPORT bool CanHaveInternalField(int instance_type);
+
 /**
  * This class exports constants and functionality from within v8 that
  * is necessary to implement inline functions in the v8 api.  Don't
@@ -262,8 +268,9 @@ class Internals {
   static const int kOddballType = 0x43;
   static const int kForeignType = 0x46;
   static const int kJSSpecialApiObjectType = 0x410;
-  static const int kJSApiObjectType = 0x420;
   static const int kJSObjectType = 0x421;
+  static const int kFirstJSApiObjectType = 0x422;
+  static const int kLastJSApiObjectType = 0x80A;
 
   static const int kUndefinedOddballKind = 5;
   static const int kNullOddballKind = 3;
@@ -504,6 +511,15 @@ V8_INLINE void PerformCastCheck(T* data) {
 class BackingStoreBase {};
 
 }  // namespace internal
+
+V8_EXPORT bool CopyAndConvertArrayToCppBufferInt32(Local<Array> src,
+                                                   int32_t* dst,
+                                                   uint32_t max_length);
+
+V8_EXPORT bool CopyAndConvertArrayToCppBufferFloat64(Local<Array> src,
+                                                     double* dst,
+                                                     uint32_t max_length);
+
 }  // namespace v8
 
 #endif  // INCLUDE_V8_INTERNAL_H_
diff --git a/chromium/v8/include/v8-metrics.h b/chromium/v8/include/v8-metrics.h
index 2404cc0a4c3..a6eea6a8645 100644
--- a/chromium/v8/include/v8-metrics.h
+++ b/chromium/v8/include/v8-metrics.h
@@ -50,11 +50,19 @@ struct GarbageCollectionFullMainThreadIncrementalMark {
   int64_t cpp_wall_clock_duration_in_us = -1;
 };
 
+struct GarbageCollectionFullMainThreadBatchedIncrementalMark {
+  std::vector<GarbageCollectionFullMainThreadIncrementalMark> events;
+};
+
 struct GarbageCollectionFullMainThreadIncrementalSweep {
   int64_t wall_clock_duration_in_us = -1;
   int64_t cpp_wall_clock_duration_in_us = -1;
 };
 
+struct GarbageCollectionFullMainThreadBatchedIncrementalSweep {
+  std::vector<GarbageCollectionFullMainThreadIncrementalSweep> events;
+};
+
 struct GarbageCollectionYoungCycle {
   int64_t total_wall_clock_duration_in_us = -1;
   int64_t main_thread_wall_clock_duration_in_us = -1;
@@ -70,6 +78,7 @@ struct WasmModuleDecoded {
   size_t module_size_in_bytes = 0;
   size_t function_count = 0;
   int64_t wall_clock_duration_in_us = -1;
+  int64_t cpu_duration_in_us = -1;
 };
 
 struct WasmModuleCompiled {
@@ -82,6 +91,7 @@ struct WasmModuleCompiled {
   size_t code_size_in_bytes = 0;
   size_t liftoff_bailout_count = 0;
   int64_t wall_clock_duration_in_us = -1;
+  int64_t cpu_duration_in_us = -1;
 };
 
 struct WasmModuleInstantiated {
@@ -95,20 +105,23 @@ struct WasmModuleTieredUp {
   bool lazy = false;
   size_t code_size_in_bytes = 0;
   int64_t wall_clock_duration_in_us = -1;
+  int64_t cpu_duration_in_us = -1;
 };
 
 struct WasmModulesPerIsolate {
   size_t count = 0;
 };
 
-#define V8_MAIN_THREAD_METRICS_EVENTS(V)             \
-  V(GarbageCollectionFullCycle)                      \
-  V(GarbageCollectionFullMainThreadIncrementalMark)  \
-  V(GarbageCollectionFullMainThreadIncrementalSweep) \
-  V(GarbageCollectionYoungCycle)                     \
-  V(WasmModuleDecoded)                               \
-  V(WasmModuleCompiled)                              \
-  V(WasmModuleInstantiated)                          \
+#define V8_MAIN_THREAD_METRICS_EVENTS(V)                    \
+  V(GarbageCollectionFullCycle)                             \
+  V(GarbageCollectionFullMainThreadIncrementalMark)         \
+  V(GarbageCollectionFullMainThreadBatchedIncrementalMark)  \
+  V(GarbageCollectionFullMainThreadIncrementalSweep)        \
+  V(GarbageCollectionFullMainThreadBatchedIncrementalSweep) \
+  V(GarbageCollectionYoungCycle)                            \
+  V(WasmModuleDecoded)                                      \
+  V(WasmModuleCompiled)                                     \
+  V(WasmModuleInstantiated)                                 \
   V(WasmModuleTieredUp)
 
 #define V8_THREAD_SAFE_METRICS_EVENTS(V) V(WasmModulesPerIsolate)
diff --git a/chromium/v8/include/v8-version.h b/chromium/v8/include/v8-version.h
index 4ad744f2a84..e8527ea0eca 100644
--- a/chromium/v8/include/v8-version.h
+++ b/chromium/v8/include/v8-version.h
@@ -9,9 +9,9 @@
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
 #define V8_MAJOR_VERSION 9
-#define V8_MINOR_VERSION 2
-#define V8_BUILD_NUMBER 230
-#define V8_PATCH_LEVEL 30
+#define V8_MINOR_VERSION 4
+#define V8_BUILD_NUMBER 146
+#define V8_PATCH_LEVEL 23
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/chromium/v8/include/v8.h b/chromium/v8/include/v8.h
index c4720ca6954..78c454e334f 100644
--- a/chromium/v8/include/v8.h
+++ b/chromium/v8/include/v8.h
@@ -50,6 +50,7 @@ class CFunction;
 class CallHandlerHelper;
 class Context;
 class CppHeap;
+class CTypeInfo;
 class Data;
 class Date;
 class EscapableHandleScope;
@@ -127,6 +128,7 @@ template<typename T> class PropertyCallbackInfo;
 template<typename T> class ReturnValue;
 
 namespace internal {
+class BackgroundDeserializeTask;
 class BasicTracedReferenceExtractor;
 class ExternalString;
 class FunctionCallbackArguments;
@@ -885,6 +887,8 @@ class TracedReferenceBase {
         std::memory_order_relaxed);
   }
 
+  V8_EXPORT void CheckValue() const;
+
   // val_ points to a GlobalHandles node.
   internal::Address* val_ = nullptr;
 
@@ -926,8 +930,18 @@ class BasicTracedReference : public TracedReferenceBase {
         const_cast<BasicTracedReference<T>&>(*this));
   }
 
-  T* operator->() const { return reinterpret_cast<T*>(val_); }
-  T* operator*() const { return reinterpret_cast<T*>(val_); }
+  T* operator->() const {
+#ifdef V8_ENABLE_CHECKS
+    CheckValue();
+#endif  // V8_ENABLE_CHECKS
+    return reinterpret_cast<T*>(val_);
+  }
+  T* operator*() const {
+#ifdef V8_ENABLE_CHECKS
+    CheckValue();
+#endif  // V8_ENABLE_CHECKS
+    return reinterpret_cast<T*>(val_);
+  }
 
  private:
   enum DestructionMode { kWithDestructor, kWithoutDestructor };
@@ -1427,7 +1441,7 @@ class ScriptOriginOptions {
  */
 class ScriptOrigin {
  public:
-  V8_DEPRECATE_SOON("Use constructor with primitive C++ types")
+  V8_DEPRECATED("Use constructor with primitive C++ types")
   V8_INLINE explicit ScriptOrigin(
       Local<Value> resource_name, Local<Integer> resource_line_offset,
       Local<Integer> resource_column_offset,
@@ -1438,7 +1452,7 @@ class ScriptOrigin {
       Local<Boolean> is_wasm = Local<Boolean>(),
       Local<Boolean> is_module = Local<Boolean>(),
       Local<PrimitiveArray> host_defined_options = Local<PrimitiveArray>());
-  V8_DEPRECATE_SOON("Use constructor that takes an isolate")
+  V8_DEPRECATED("Use constructor that takes an isolate")
   V8_INLINE explicit ScriptOrigin(
       Local<Value> resource_name, int resource_line_offset = 0,
       int resource_column_offset = 0,
@@ -1457,11 +1471,11 @@ class ScriptOrigin {
       Local<PrimitiveArray> host_defined_options = Local<PrimitiveArray>());
 
   V8_INLINE Local<Value> ResourceName() const;
-  V8_DEPRECATE_SOON("Use getter with primitvie C++ types.")
+  V8_DEPRECATED("Use getter with primitvie C++ types.")
   V8_INLINE Local<Integer> ResourceLineOffset() const;
-  V8_DEPRECATE_SOON("Use getter with primitvie C++ types.")
+  V8_DEPRECATED("Use getter with primitvie C++ types.")
   V8_INLINE Local<Integer> ResourceColumnOffset() const;
-  V8_DEPRECATE_SOON("Use getter with primitvie C++ types.")
+  V8_DEPRECATED("Use getter with primitvie C++ types.")
   V8_INLINE Local<Integer> ScriptID() const;
   V8_INLINE int LineOffset() const;
   V8_INLINE int ColumnOffset() const;
@@ -1613,14 +1627,14 @@ class V8_EXPORT Module : public Data {
   /**
    * Returns the number of modules requested by this module.
    */
-  V8_DEPRECATE_SOON("Use Module::GetModuleRequests() and FixedArray::Length().")
+  V8_DEPRECATED("Use Module::GetModuleRequests() and FixedArray::Length().")
   int GetModuleRequestsLength() const;
 
   /**
    * Returns the ith module specifier in this module.
    * i must be < GetModuleRequestsLength() and >= 0.
    */
-  V8_DEPRECATE_SOON(
+  V8_DEPRECATED(
       "Use Module::GetModuleRequests() and ModuleRequest::GetSpecifier().")
   Local<String> GetModuleRequest(int i) const;
 
@@ -1628,7 +1642,7 @@ class V8_EXPORT Module : public Data {
    * Returns the source location (line number and column number) of the ith
    * module specifier's first occurrence in this module.
    */
-  V8_DEPRECATE_SOON(
+  V8_DEPRECATED(
       "Use Module::GetModuleRequests(), ModuleRequest::GetSourceOffset(), and "
       "Module::SourceOffsetToLocation().")
   Location GetModuleRequestLocation(int i) const;
@@ -1649,7 +1663,7 @@ class V8_EXPORT Module : public Data {
    */
   int GetIdentityHash() const;
 
-  using ResolveCallback V8_DEPRECATE_SOON("Use ResolveModuleCallback") =
+  using ResolveCallback V8_DEPRECATED("Use ResolveModuleCallback") =
       MaybeLocal<Module> (*)(Local<Context> context, Local<String> specifier,
                              Local<Module> referrer);
   using ResolveModuleCallback = MaybeLocal<Module> (*)(
@@ -1663,7 +1677,7 @@ class V8_EXPORT Module : public Data {
    * instantiation. (In the case where the callback throws an exception, that
    * exception is propagated.)
    */
-  V8_DEPRECATE_SOON(
+  V8_DEPRECATED(
       "Use the version of InstantiateModule that takes a ResolveModuleCallback "
       "parameter")
   V8_WARN_UNUSED_RESULT Maybe<bool> InstantiateModule(Local<Context> context,
@@ -1754,13 +1768,6 @@ class V8_EXPORT Module : public Data {
    */
   V8_WARN_UNUSED_RESULT Maybe<bool> SetSyntheticModuleExport(
       Isolate* isolate, Local<String> export_name, Local<Value> export_value);
-  V8_DEPRECATED(
-      "Use the preceding SetSyntheticModuleExport with an Isolate parameter, "
-      "instead of the one that follows.  The former will throw a runtime "
-      "error if called for an export that doesn't exist (as per spec); "
-      "the latter will crash with a failed CHECK().")
-  void SetSyntheticModuleExport(Local<String> export_name,
-                                Local<Value> export_value);
 
   V8_INLINE static Module* Cast(Data* data);
 
@@ -1801,6 +1808,8 @@ enum class ScriptType { kClassic, kModule };
  */
 class V8_EXPORT ScriptCompiler {
  public:
+  class ConsumeCodeCacheTask;
+
   /**
    * Compilation data that the embedder can cache and pass back to speed up
    * future compilations. The data is produced if the CompilerOptions passed to
@@ -1844,12 +1853,15 @@ class V8_EXPORT ScriptCompiler {
    */
   class Source {
    public:
-    // Source takes ownership of CachedData.
+    // Source takes ownership of both CachedData and CodeCacheConsumeTask.
     V8_INLINE Source(Local<String> source_string, const ScriptOrigin& origin,
-                     CachedData* cached_data = nullptr);
-    V8_INLINE explicit Source(Local<String> source_string,
-                              CachedData* cached_data = nullptr);
-    V8_INLINE ~Source();
+                     CachedData* cached_data = nullptr,
+                     ConsumeCodeCacheTask* consume_cache_task = nullptr);
+    // Source takes ownership of both CachedData and CodeCacheConsumeTask.
+    V8_INLINE explicit Source(
+        Local<String> source_string, CachedData* cached_data = nullptr,
+        ConsumeCodeCacheTask* consume_cache_task = nullptr);
+    V8_INLINE ~Source() = default;
 
     // Ownership of the CachedData or its buffers is *not* transferred to the
     // caller. The CachedData object is alive as long as the Source object is
@@ -1858,10 +1870,6 @@ class V8_EXPORT ScriptCompiler {
 
     V8_INLINE const ScriptOriginOptions& GetResourceOptions() const;
 
-    // Prevent copying.
-    Source(const Source&) = delete;
-    Source& operator=(const Source&) = delete;
-
    private:
     friend class ScriptCompiler;
 
@@ -1878,7 +1886,8 @@ class V8_EXPORT ScriptCompiler {
     // Cached data from previous compilation (if a kConsume*Cache flag is
     // set), or hold newly generated cache data (kProduce*Cache flags) are
     // set when calling a compile method.
-    CachedData* cached_data;
+    std::unique_ptr<CachedData> cached_data;
+    std::unique_ptr<ConsumeCodeCacheTask> consume_cache_task;
   };
 
   /**
@@ -1940,10 +1949,6 @@ class V8_EXPORT ScriptCompiler {
    public:
     enum Encoding { ONE_BYTE, TWO_BYTE, UTF8, WINDOWS_1252 };
 
-    V8_DEPRECATED(
-        "This class takes ownership of source_stream, so use the constructor "
-        "taking a unique_ptr to make these semantics clearer")
-    StreamedSource(ExternalSourceStream* source_stream, Encoding encoding);
     StreamedSource(std::unique_ptr<ExternalSourceStream> source_stream,
                    Encoding encoding);
     ~StreamedSource();
@@ -1975,6 +1980,26 @@ class V8_EXPORT ScriptCompiler {
     internal::ScriptStreamingData* data_;
   };
 
+  /**
+   * A task which the embedder must run on a background thread to
+   * consume a V8 code cache. Returned by
+   * ScriptCompiler::StarConsumingCodeCache.
+   */
+  class V8_EXPORT ConsumeCodeCacheTask final {
+   public:
+    ~ConsumeCodeCacheTask();
+
+    void Run();
+
+   private:
+    friend class ScriptCompiler;
+
+    explicit ConsumeCodeCacheTask(
+        std::unique_ptr<internal::BackgroundDeserializeTask> impl);
+
+    std::unique_ptr<internal::BackgroundDeserializeTask> impl_;
+  };
+
   enum CompileOptions {
     kNoCompileOptions = 0,
     kConsumeCodeCache,
@@ -2048,14 +2073,13 @@ class V8_EXPORT ScriptCompiler {
    * This API allows to start the streaming with as little data as possible, and
    * the remaining data (for example, the ScriptOrigin) is passed to Compile.
    */
-  V8_DEPRECATED("Use ScriptCompiler::StartStreaming instead.")
-  static ScriptStreamingTask* StartStreamingScript(
-      Isolate* isolate, StreamedSource* source,
-      CompileOptions options = kNoCompileOptions);
   static ScriptStreamingTask* StartStreaming(
       Isolate* isolate, StreamedSource* source,
       ScriptType type = ScriptType::kClassic);
 
+  static ConsumeCodeCacheTask* StartConsumingCodeCache(
+      Isolate* isolate, std::unique_ptr<CachedData> source);
+
   /**
    * Compiles a streamed script (bound to current context).
    *
@@ -4290,11 +4314,13 @@ class V8_EXPORT Object : public Value {
   /**
    * Returns the context in which the object was created.
    */
+  // TODO(chromium:1166077): Mark as deprecate once users are updated.
   V8_DEPRECATE_SOON("Use MaybeLocal<Context> GetCreationContext()")
   Local<Context> CreationContext();
   MaybeLocal<Context> GetCreationContext();
 
   /** Same as above, but works for Persistents */
+  // TODO(chromium:1166077): Mark as deprecate once users are updated.
   V8_DEPRECATE_SOON(
       "Use MaybeLocal<Context> GetCreationContext(const "
       "PersistentBase<Object>& object)")
@@ -4419,6 +4445,7 @@ class V8_EXPORT Array : public Object {
   static Local<Array> New(Isolate* isolate, Local<Value>* elements,
                           size_t length);
   V8_INLINE static Array* Cast(Value* obj);
+
  private:
   Array();
   static void CheckCast(Value* obj);
@@ -4894,6 +4921,12 @@ class V8_EXPORT Promise : public Object {
    */
   void MarkAsHandled();
 
+  /**
+   * Marks this promise as silent to prevent pausing the debugger when the
+   * promise is rejected.
+   */
+  void MarkAsSilent();
+
   V8_INLINE static Promise* Cast(Value* obj);
 
   static const int kEmbedderFieldCount = V8_PROMISE_INTERNAL_FIELD_COUNT;
@@ -6067,7 +6100,8 @@ class V8_EXPORT Template : public Data {
            PropertyAttribute attributes = None);
   void SetPrivate(Local<Private> name, Local<Data> value,
                   PropertyAttribute attributes = None);
-  V8_INLINE void Set(Isolate* isolate, const char* name, Local<Data> value);
+  V8_INLINE void Set(Isolate* isolate, const char* name, Local<Data> value,
+                     PropertyAttribute attributes = None);
 
   void SetAccessorProperty(
      Local<Name> name,
@@ -6497,7 +6531,9 @@ class V8_EXPORT FunctionTemplate : public Template {
       Local<Signature> signature = Local<Signature>(), int length = 0,
       ConstructorBehavior behavior = ConstructorBehavior::kAllow,
       SideEffectType side_effect_type = SideEffectType::kHasSideEffect,
-      const CFunction* c_function = nullptr);
+      const CFunction* c_function = nullptr, uint16_t instance_type = 0,
+      uint16_t allowed_receiver_instance_type_range_start = 0,
+      uint16_t allowed_receiver_instance_type_range_end = 0);
 
   /** Creates a function template for multiple overloaded fast API calls.*/
   static Local<FunctionTemplate> NewWithCFunctionOverloads(
@@ -7217,7 +7253,9 @@ using MessageCallback = void (*)(Local<Message> message, Local<Value> data);
 
 // --- Tracing ---
 
-using LogEventCallback = void (*)(const char* name, int event);
+enum LogEventStatus : int { kStart = 0, kEnd = 1, kStamp = 2 };
+using LogEventCallback = void (*)(const char* name,
+                                  int /* LogEventStatus */ status);
 
 /**
  * Create new error objects by calling the corresponding error object
@@ -7293,7 +7331,7 @@ using CallCompletedCallback = void (*)(Isolate*);
  * fails (e.g. due to stack overflow), the embedder must propagate
  * that exception by returning an empty MaybeLocal.
  */
-using HostImportModuleDynamicallyCallback V8_DEPRECATE_SOON(
+using HostImportModuleDynamicallyCallback V8_DEPRECATED(
     "Use HostImportModuleDynamicallyWithImportAssertionsCallback instead") =
     MaybeLocal<Promise> (*)(Local<Context> context,
                             Local<ScriptOrModule> referrer,
@@ -8341,11 +8379,6 @@ class V8_EXPORT Isolate {
      */
     int embedder_wrapper_type_index = -1;
     int embedder_wrapper_object_index = -1;
-
-    V8_DEPRECATED(
-        "Setting this has no effect. Embedders should ignore import assertions "
-        "that they do not use.")
-    std::vector<std::string> supported_import_assertions;
   };
 
   /**
@@ -8542,7 +8575,7 @@ class V8_EXPORT Isolate {
     kDateToLocaleTimeString = 68,
     kAttemptOverrideReadOnlyOnPrototypeSloppy = 69,
     kAttemptOverrideReadOnlyOnPrototypeStrict = 70,
-    kOptimizedFunctionWithOneShotBytecode = 71,
+    kOptimizedFunctionWithOneShotBytecode = 71,  // Unused.
     kRegExpMatchIsTrueishOnNonJSRegExp = 72,
     kRegExpMatchIsFalseishOnJSRegExp = 73,
     kDateGetTimezoneOffset = 74,  // Unused.
@@ -8645,6 +8678,14 @@ class V8_EXPORT Isolate {
   static Isolate* GetCurrent();
 
   /**
+   * Returns the entered isolate for the current thread or NULL in
+   * case there is no current isolate.
+   *
+   * No checks are performed by this method.
+   */
+  static Isolate* TryGetCurrent();
+
+  /**
    * Clears the set of objects held strongly by the heap. This set of
    * objects are originally built when a WeakRef is created or
    * successfully dereferenced.
@@ -8676,7 +8717,7 @@ class V8_EXPORT Isolate {
    * This specifies the callback called by the upcoming dynamic
    * import() language feature to load modules.
    */
-  V8_DEPRECATE_SOON(
+  V8_DEPRECATED(
       "Use the version of SetHostImportModuleDynamicallyCallback that takes a "
       "HostImportModuleDynamicallyWithImportAssertionsCallback instead")
   void SetHostImportModuleDynamicallyCallback(
@@ -8711,6 +8752,13 @@ class V8_EXPORT Isolate {
   void MemoryPressureNotification(MemoryPressureLevel level);
 
   /**
+   * Drop non-essential caches. Should only be called from testing code.
+   * The method can potentially block for a long time and does not necessarily
+   * trigger GC.
+   */
+  void ClearCachesForTesting();
+
+  /**
    * Methods below this point require holding a lock (using Locker) in
    * a multi-threaded environment.
    */
@@ -8842,10 +8890,6 @@ class V8_EXPORT Isolate {
       std::unique_ptr<MeasureMemoryDelegate> delegate,
       MeasureMemoryExecution execution = MeasureMemoryExecution::kDefault);
 
-  V8_DEPRECATED("Use the version with a delegate")
-  MaybeLocal<Promise> MeasureMemory(Local<Context> context,
-                                    MeasureMemoryMode mode);
-
   /**
    * Get a call stack sample from the isolate.
    * \param state Execution state.
@@ -9523,13 +9567,6 @@ class V8_EXPORT Isolate {
    * Set the callback to invoke to check if code generation from
    * strings should be allowed.
    */
-  V8_DEPRECATED(
-      "Use Isolate::SetModifyCodeGenerationFromStringsCallback with "
-      "ModifyCodeGenerationFromStringsCallback2 instead. See "
-      "http://crbug.com/1096017 and TC39 Dynamic Code Brand Checks proposal "
-      "at https://github.com/tc39/proposal-dynamic-code-brand-checks.")
-  void SetModifyCodeGenerationFromStringsCallback(
-      ModifyCodeGenerationFromStringsCallback callback);
   void SetModifyCodeGenerationFromStringsCallback(
       ModifyCodeGenerationFromStringsCallback2 callback);
 
@@ -9877,30 +9914,6 @@ class V8_EXPORT V8 {
    */
   static void ShutdownPlatform();
 
-#if V8_OS_POSIX
-  /**
-   * Give the V8 signal handler a chance to handle a fault.
-   *
-   * This function determines whether a memory access violation can be recovered
-   * by V8. If so, it will return true and modify context to return to a code
-   * fragment that can recover from the fault. Otherwise, TryHandleSignal will
-   * return false.
-   *
-   * The parameters to this function correspond to those passed to a Linux
-   * signal handler.
-   *
-   * \param signal_number The signal number.
-   *
-   * \param info A pointer to the siginfo_t structure provided to the signal
-   * handler.
-   *
-   * \param context The third argument passed to the Linux signal handler, which
-   * points to a ucontext_t structure.
-   */
-  V8_DEPRECATED("Use TryHandleWebAssemblyTrapPosix")
-  static bool TryHandleSignal(int signal_number, void* info, void* context);
-#endif  // V8_OS_POSIX
-
   /**
    * Activate trap-based bounds checking for WebAssembly.
    *
@@ -9928,15 +9941,6 @@ class V8_EXPORT V8 {
    */
   static void GetSharedMemoryStatistics(SharedMemoryStatistics* statistics);
 
-  /**
-   * Notifies V8 that the process is cross-origin-isolated, which enables
-   * defining the SharedArrayBuffer function on the global object of Contexts.
-   */
-  V8_DEPRECATED(
-      "Use the command line argument --enable-sharedarraybuffer-per-context "
-      "together with SetSharedArrayBufferConstructorEnabledCallback")
-  static void SetIsCrossOriginIsolated();
-
  private:
   V8();
 
@@ -11547,7 +11551,8 @@ int ScriptOrigin::ScriptId() const { return script_id_; }
 Local<Value> ScriptOrigin::SourceMapUrl() const { return source_map_url_; }
 
 ScriptCompiler::Source::Source(Local<String> string, const ScriptOrigin& origin,
-                               CachedData* data)
+                               CachedData* data,
+                               ConsumeCodeCacheTask* consume_cache_task)
     : source_string(string),
       resource_name(origin.ResourceName()),
       resource_line_offset(origin.LineOffset()),
@@ -11555,21 +11560,18 @@ ScriptCompiler::Source::Source(Local<String> string, const ScriptOrigin& origin,
       resource_options(origin.Options()),
       source_map_url(origin.SourceMapUrl()),
       host_defined_options(origin.HostDefinedOptions()),
-      cached_data(data) {}
-
-ScriptCompiler::Source::Source(Local<String> string,
-                               CachedData* data)
-    : source_string(string), cached_data(data) {}
-
-
-ScriptCompiler::Source::~Source() {
-  delete cached_data;
-}
+      cached_data(data),
+      consume_cache_task(consume_cache_task) {}
 
+ScriptCompiler::Source::Source(Local<String> string, CachedData* data,
+                               ConsumeCodeCacheTask* consume_cache_task)
+    : source_string(string),
+      cached_data(data),
+      consume_cache_task(consume_cache_task) {}
 
 const ScriptCompiler::CachedData* ScriptCompiler::Source::GetCachedData()
     const {
-  return cached_data;
+  return cached_data.get();
 }
 
 const ScriptOriginOptions& ScriptCompiler::Source::GetResourceOptions() const {
@@ -11580,10 +11582,11 @@ Local<Boolean> Boolean::New(Isolate* isolate, bool value) {
   return value ? True(isolate) : False(isolate);
 }
 
-void Template::Set(Isolate* isolate, const char* name, Local<Data> value) {
+void Template::Set(Isolate* isolate, const char* name, Local<Data> value,
+                   PropertyAttribute attributes) {
   Set(String::NewFromUtf8(isolate, name, NewStringType::kInternalized)
           .ToLocalChecked(),
-      value);
+      value, attributes);
 }
 
 FunctionTemplate* FunctionTemplate::Cast(Data* data) {
@@ -11621,10 +11624,8 @@ Local<Value> Object::GetInternalField(int index) {
   A obj = *reinterpret_cast<A*>(this);
   // Fast path: If the object is a plain JSObject, which is the common case, we
   // know where to find the internal fields and can return the value directly.
-  auto instance_type = I::GetInstanceType(obj);
-  if (instance_type == I::kJSObjectType ||
-      instance_type == I::kJSApiObjectType ||
-      instance_type == I::kJSSpecialApiObjectType) {
+  int instance_type = I::GetInstanceType(obj);
+  if (v8::internal::CanHaveInternalField(instance_type)) {
     int offset = I::kJSObjectHeaderSize + (I::kEmbedderDataSlotSize * index);
     A value = I::ReadRawField<A>(obj, offset);
 #ifdef V8_COMPRESS_POINTERS
@@ -11650,9 +11651,7 @@ void* Object::GetAlignedPointerFromInternalField(int index) {
   // Fast path: If the object is a plain JSObject, which is the common case, we
   // know where to find the internal fields and can return the value directly.
   auto instance_type = I::GetInstanceType(obj);
-  if (V8_LIKELY(instance_type == I::kJSObjectType ||
-                instance_type == I::kJSApiObjectType ||
-                instance_type == I::kJSSpecialApiObjectType)) {
+  if (v8::internal::CanHaveInternalField(instance_type)) {
     int offset = I::kJSObjectHeaderSize + (I::kEmbedderDataSlotSize * index);
 #ifdef V8_HEAP_SANDBOX
     offset += I::kEmbedderDataSlotRawPayloadOffset;
diff --git a/chromium/v8/include/v8config.h b/chromium/v8/include/v8config.h
index c1bb691f878..b010b65dfd6 100644
--- a/chromium/v8/include/v8config.h
+++ b/chromium/v8/include/v8config.h
@@ -86,51 +86,80 @@ path. Add it with -I<path> to the command line
 # define V8_OS_ANDROID 1
 # define V8_OS_LINUX 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "android"
+
 #elif defined(__APPLE__)
 # define V8_OS_BSD 1
 # define V8_OS_MACOSX 1
 # define V8_OS_POSIX 1
 # if defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE
 #  define V8_OS_IOS 1
+#  define V8_OS_STRING "ios"
+# else
+#  define V8_OS_STRING "macos"
 # endif  // defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE
+
 #elif defined(__CYGWIN__)
 # define V8_OS_CYGWIN 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "cygwin"
+
 #elif defined(__linux__)
 # define V8_OS_LINUX 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "linux"
+
 #elif defined(__sun)
 # define V8_OS_POSIX 1
 # define V8_OS_SOLARIS 1
+# define V8_OS_STRING "sun"
+
 #elif defined(STARBOARD)
 # define V8_OS_STARBOARD 1
+# define V8_OS_STRING "starboard"
+
 #elif defined(_AIX)
-#define V8_OS_POSIX 1
-#define V8_OS_AIX 1
+# define V8_OS_POSIX 1
+# define V8_OS_AIX 1
+# define V8_OS_STRING "aix"
+
 #elif defined(__FreeBSD__)
 # define V8_OS_BSD 1
 # define V8_OS_FREEBSD 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "freebsd"
+
 #elif defined(__Fuchsia__)
 # define V8_OS_FUCHSIA 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "fuchsia"
+
 #elif defined(__DragonFly__)
 # define V8_OS_BSD 1
 # define V8_OS_DRAGONFLYBSD 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "dragonflybsd"
+
 #elif defined(__NetBSD__)
 # define V8_OS_BSD 1
 # define V8_OS_NETBSD 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "netbsd"
+
 #elif defined(__OpenBSD__)
 # define V8_OS_BSD 1
 # define V8_OS_OPENBSD 1
 # define V8_OS_POSIX 1
+# define V8_OS_STRING "openbsd"
+
 #elif defined(__QNXNTO__)
 # define V8_OS_POSIX 1
 # define V8_OS_QNX 1
+# define V8_OS_STRING "qnx"
+
 #elif defined(_WIN32)
 # define V8_OS_WIN 1
+# define V8_OS_STRING "windows"
 #endif
 
 // -----------------------------------------------------------------------------
@@ -195,6 +224,22 @@ path. Add it with -I<path> to the command line
 
 #endif  // V8_HAVE_TARGET_OS
 
+#if defined(V8_TARGET_OS_ANDROID)
+# define V8_TARGET_OS_STRING "android"
+#elif defined(V8_TARGET_OS_FUCHSIA)
+# define V8_TARGET_OS_STRING "fuchsia"
+#elif defined(V8_TARGET_OS_IOS)
+# define V8_TARGET_OS_STRING "ios"
+#elif defined(V8_TARGET_OS_LINUX)
+# define V8_TARGET_OS_STRING "linux"
+#elif defined(V8_TARGET_OS_MACOSX)
+# define V8_TARGET_OS_STRING "macos"
+#elif defined(V8_TARGET_OS_WINDOWS)
+# define V8_TARGET_OS_STRING "windows"
+#else
+# define V8_TARGET_OS_STRING "unknown"
+#endif
+
 // -----------------------------------------------------------------------------
 // C library detection
 //
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2021-10-26 13:57:00 +0200
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2021-11-02 11:31:01 +0000
commit	1943b3c2a1dcee36c233724fc4ee7613d71b9cf6 (patch)
tree	8c1b5f12357025c197da5427ae02cfdc2f3570d6 /chromium/v8/include
parent	21ba0c5d4bf8fba15dddd97cd693bad2358b77fd (diff)
download	qtwebengine-chromium-1943b3c2a1dcee36c233724fc4ee7613d71b9cf6.tar.gz