Upgrade V8 binary

deps/include/OWNERS

@@ -1,22 +1,15 @@
 [email protected]
 [email protected]
-danno@chromium.org
+leszeks@chromium.org
 [email protected]
-[email protected]
 [email protected]
 [email protected]
 
 per-file *DEPS=file:../COMMON_OWNERS
 per-file v8-internal.h=file:../COMMON_OWNERS
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
-per-file [email protected]
+per-file v8-inspector.h=file:../src/inspector/OWNERS
+per-file v8-inspector-protocol.h=file:../src/inspector/OWNERS
+per-file js_protocol.pdl=file:../src/inspector/OWNERS
 
 # For branch updates:
 per-file v8-version.h=file:../INFRA_OWNERS

deps/include/cppgc/allocation.h

@@ -5,24 +5,21 @@
 #ifndef INCLUDE_CPPGC_ALLOCATION_H_
 #define INCLUDE_CPPGC_ALLOCATION_H_
 
-#include <stdint.h>
-
 #include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <new>
+#include <type_traits>
+#include <utility>
 
 #include "cppgc/custom-space.h"
-#include "cppgc/garbage-collected.h"
 #include "cppgc/internal/api-constants.h"
 #include "cppgc/internal/gc-info.h"
+#include "cppgc/type-traits.h"
+#include "v8config.h"  // NOLINT(build/include_directory)
 
 namespace cppgc {
 
-template <typename T>
-class MakeGarbageCollectedTraitBase;
-
-namespace internal {
-class ObjectAllocator;
-}  // namespace internal
-
 /**
  * AllocationHandle is used to allocate garbage-collected objects.
  */
@@ -43,6 +40,28 @@ class V8_EXPORT MakeGarbageCollectedTraitInternal {
                                       std::memory_order_release);
   }
 
+  template <typename U, typename CustomSpace>
+  struct SpacePolicy {
+    static void* Allocate(AllocationHandle& handle, size_t size) {
+      // Custom space.
+      static_assert(std::is_base_of<CustomSpaceBase, CustomSpace>::value,
+                    "Custom space must inherit from CustomSpaceBase.");
+      return MakeGarbageCollectedTraitInternal::Allocate(
+          handle, size, internal::GCInfoTrait<U>::Index(),
+          CustomSpace::kSpaceIndex);
+    }
+  };
+
+  template <typename U>
+  struct SpacePolicy<U, void> {
+    static void* Allocate(AllocationHandle& handle, size_t size) {
+      // Default space.
+      return MakeGarbageCollectedTraitInternal::Allocate(
+          handle, size, internal::GCInfoTrait<U>::Index());
+    }
+  };
+
+ private:
   static void* Allocate(cppgc::AllocationHandle& handle, size_t size,
                         GCInfoIndex index);
   static void* Allocate(cppgc::AllocationHandle& handle, size_t size,
@@ -71,27 +90,6 @@ class MakeGarbageCollectedTraitBase
                         internal::api_constants::kLargeObjectSizeThreshold,
                 "GarbageCollectedMixin may not be a large object");
 
-  template <typename U, typename CustomSpace>
-  struct SpacePolicy {
-    static void* Allocate(AllocationHandle& handle, size_t size) {
-      // Custom space.
-      static_assert(std::is_base_of<CustomSpaceBase, CustomSpace>::value,
-                    "Custom space must inherit from CustomSpaceBase.");
-      return internal::MakeGarbageCollectedTraitInternal::Allocate(
-          handle, size, internal::GCInfoTrait<T>::Index(),
-          CustomSpace::kSpaceIndex);
-    }
-  };
-
-  template <typename U>
-  struct SpacePolicy<U, void> {
-    static void* Allocate(AllocationHandle& handle, size_t size) {
-      // Default space.
-      return internal::MakeGarbageCollectedTraitInternal::Allocate(
-          handle, size, internal::GCInfoTrait<T>::Index());
-    }
-  };
-
  protected:
   /**
    * Allocates memory for an object of type T.
@@ -101,9 +99,15 @@ class MakeGarbageCollectedTraitBase
    * \param size The size that should be reserved for the object.
    * \returns the memory to construct an object of type T on.
    */
-  static void* Allocate(AllocationHandle& handle, size_t size) {
-    return SpacePolicy<T, typename SpaceTrait<T>::Space>::Allocate(handle,
-                                                                   size);
+  V8_INLINE static void* Allocate(AllocationHandle& handle, size_t size) {
+    static_assert(
+        std::is_base_of<typename T::ParentMostGarbageCollectedType, T>::value,
+        "U of GarbageCollected<U> must be a base of T. Check "
+        "GarbageCollected<T> base class inheritance.");
+    return SpacePolicy<
+        typename internal::GCInfoFolding<
+            T, typename T::ParentMostGarbageCollectedType>::ResultType,
+        typename SpaceTrait<T>::Space>::Allocate(handle, size);
   }
 
   /**
@@ -112,7 +116,7 @@ class MakeGarbageCollectedTraitBase
    *
    * \param payload The base pointer the object is allocated at.
    */
-  static void MarkObjectAsFullyConstructed(const void* payload) {
+  V8_INLINE static void MarkObjectAsFullyConstructed(const void* payload) {
     internal::MakeGarbageCollectedTraitInternal::MarkObjectAsFullyConstructed(
         payload);
   }

deps/include/cppgc/cross-thread-persistent.h

@@ -13,12 +13,34 @@
 #include "cppgc/visitor.h"
 
 namespace cppgc {
-
 namespace internal {
 
+// Wrapper around PersistentBase that allows accessing poisoned memory when
+// using ASAN. This is needed as the GC of the heap that owns the value
+// of a CTP, may clear it (heap termination, weakness) while the object
+// holding the CTP may be poisoned as itself may be deemed dead.
+class CrossThreadPersistentBase : public PersistentBase {
+ public:
+  CrossThreadPersistentBase() = default;
+  explicit CrossThreadPersistentBase(const void* raw) : PersistentBase(raw) {}
+
+  V8_CLANG_NO_SANITIZE("address") const void* GetValueFromGC() const {
+    return raw_;
+  }
+
+  V8_CLANG_NO_SANITIZE("address")
+  PersistentNode* GetNodeFromGC() const { return node_; }
+
+  V8_CLANG_NO_SANITIZE("address")
+  void ClearFromGC() const {
+    raw_ = nullptr;
+    node_ = nullptr;
+  }
+};
+
 template <typename T, typename WeaknessPolicy, typename LocationPolicy,
           typename CheckingPolicy>
-class BasicCrossThreadPersistent final : public PersistentBase,
+class BasicCrossThreadPersistent final : public CrossThreadPersistentBase,
                                          public LocationPolicy,
                                          private WeaknessPolicy,
                                          private CheckingPolicy {
@@ -28,35 +50,54 @@ class BasicCrossThreadPersistent final : public PersistentBase,
 
   ~BasicCrossThreadPersistent() { Clear(); }
 
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       const SourceLocation& loc = SourceLocation::Current())
       : LocationPolicy(loc) {}
 
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       std::nullptr_t, const SourceLocation& loc = SourceLocation::Current())
       : LocationPolicy(loc) {}
 
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       SentinelPointer s, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(s), LocationPolicy(loc) {}
+      : CrossThreadPersistentBase(s), LocationPolicy(loc) {}
 
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       T* raw, const SourceLocation& loc = SourceLocation::Current())
-      : PersistentBase(raw), LocationPolicy(loc) {
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
     if (!IsValid(raw)) return;
-    PersistentRegion& region = this->GetPersistentRegion(raw);
+    PersistentRegionLock guard;
+    CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
     SetNode(region.AllocateNode(this, &Trace));
     this->CheckPointer(raw);
   }
 
-  BasicCrossThreadPersistent(  // NOLINT
+  class UnsafeCtorTag {
+   private:
+    UnsafeCtorTag() = default;
+    template <typename U, typename OtherWeaknessPolicy,
+              typename OtherLocationPolicy, typename OtherCheckingPolicy>
+    friend class BasicCrossThreadPersistent;
+  };
+
+  BasicCrossThreadPersistent(
+      UnsafeCtorTag, T* raw,
+      const SourceLocation& loc = SourceLocation::Current())
+      : CrossThreadPersistentBase(raw), LocationPolicy(loc) {
+    if (!IsValid(raw)) return;
+    CrossThreadPersistentRegion& region = this->GetPersistentRegion(raw);
+    SetNode(region.AllocateNode(this, &Trace));
+    this->CheckPointer(raw);
+  }
+
+  BasicCrossThreadPersistent(
       T& raw, const SourceLocation& loc = SourceLocation::Current())
       : BasicCrossThreadPersistent(&raw, loc) {}
 
   template <typename U, typename MemberBarrierPolicy,
             typename MemberWeaknessTag, typename MemberCheckingPolicy,
             typename = std::enable_if_t<std::is_base_of<T, U>::value>>
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       internal::BasicMember<U, MemberBarrierPolicy, MemberWeaknessTag,
                             MemberCheckingPolicy>
           member,
@@ -75,7 +116,7 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   template <typename U, typename OtherWeaknessPolicy,
             typename OtherLocationPolicy, typename OtherCheckingPolicy,
             typename = std::enable_if_t<std::is_base_of<T, U>::value>>
-  BasicCrossThreadPersistent(  // NOLINT
+  BasicCrossThreadPersistent(
       const BasicCrossThreadPersistent<U, OtherWeaknessPolicy,
                                        OtherLocationPolicy,
                                        OtherCheckingPolicy>& other,
@@ -120,7 +161,7 @@ class BasicCrossThreadPersistent final : public PersistentBase,
     GetNode()->UpdateOwner(this);
     other.SetValue(nullptr);
     other.SetNode(nullptr);
-    this->CheckPointer(GetValue());
+    this->CheckPointer(Get());
     return *this;
   }
 
@@ -173,9 +214,17 @@ class BasicCrossThreadPersistent final : public PersistentBase,
     const void* old_value = GetValue();
     if (IsValid(old_value)) {
       PersistentRegionLock guard;
-      PersistentRegion& region = this->GetPersistentRegion(old_value);
-      region.FreeNode(GetNode());
-      SetNode(nullptr);
+      old_value = GetValue();
+      // The fast path check (IsValid()) does not acquire the lock. Reload
+      // the value to ensure the reference has not been cleared.
+      if (IsValid(old_value)) {
+        CrossThreadPersistentRegion& region =
+            this->GetPersistentRegion(old_value);
+        region.FreeNode(GetNode());
+        SetNode(nullptr);
+      } else {
+        CPPGC_DCHECK(!GetNode());
+      }
     }
     SetValue(nullptr);
   }
@@ -209,7 +258,7 @@ class BasicCrossThreadPersistent final : public PersistentBase,
    *
    * \returns the object.
    */
-  operator T*() const { return Get(); }  // NOLINT
+  operator T*() const { return Get(); }
 
   /**
    * Dereferences the stored object.
@@ -225,9 +274,12 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   BasicCrossThreadPersistent<U, OtherWeaknessPolicy, OtherLocationPolicy,
                              OtherCheckingPolicy>
   To() const {
+    using OtherBasicCrossThreadPersistent =
+        BasicCrossThreadPersistent<U, OtherWeaknessPolicy, OtherLocationPolicy,
+                                   OtherCheckingPolicy>;
     PersistentRegionLock guard;
-    return BasicCrossThreadPersistent<U, OtherWeaknessPolicy,
-                                      OtherLocationPolicy, OtherCheckingPolicy>(
+    return OtherBasicCrossThreadPersistent(
+        typename OtherBasicCrossThreadPersistent::UnsafeCtorTag(),
         static_cast<U*>(Get()));
   }
 
@@ -254,14 +306,22 @@ class BasicCrossThreadPersistent final : public PersistentBase,
     const void* old_value = GetValue();
     if (IsValid(old_value)) {
       PersistentRegionLock guard;
-      PersistentRegion& region = this->GetPersistentRegion(old_value);
-      if (IsValid(ptr) && (&region == &this->GetPersistentRegion(ptr))) {
-        SetValue(ptr);
-        this->CheckPointer(ptr);
-        return;
+      old_value = GetValue();
+      // The fast path check (IsValid()) does not acquire the lock. Reload
+      // the value to ensure the reference has not been cleared.
+      if (IsValid(old_value)) {
+        CrossThreadPersistentRegion& region =
+            this->GetPersistentRegion(old_value);
+        if (IsValid(ptr) && (&region == &this->GetPersistentRegion(ptr))) {
+          SetValue(ptr);
+          this->CheckPointer(ptr);
+          return;
+        }
+        region.FreeNode(GetNode());
+        SetNode(nullptr);
+      } else {
+        CPPGC_DCHECK(!GetNode());
       }
-      region.FreeNode(GetNode());
-      SetNode(nullptr);
     }
     SetValue(ptr);
     if (!IsValid(ptr)) return;
@@ -274,7 +334,8 @@ class BasicCrossThreadPersistent final : public PersistentBase,
     PersistentRegionLock::AssertLocked();
     const void* old_value = GetValue();
     if (IsValid(old_value)) {
-      PersistentRegion& region = this->GetPersistentRegion(old_value);
+      CrossThreadPersistentRegion& region =
+          this->GetPersistentRegion(old_value);
       if (IsValid(ptr) && (&region == &this->GetPersistentRegion(ptr))) {
         SetValue(ptr);
         this->CheckPointer(ptr);
@@ -290,12 +351,19 @@ class BasicCrossThreadPersistent final : public PersistentBase,
   }
 
   void ClearFromGC() const {
-    if (IsValid(GetValue())) {
-      WeaknessPolicy::GetPersistentRegion(GetValue()).FreeNode(GetNode());
-      PersistentBase::ClearFromGC();
+    if (IsValid(GetValueFromGC())) {
+      WeaknessPolicy::GetPersistentRegion(GetValueFromGC())
+          .FreeNode(GetNodeFromGC());
+      CrossThreadPersistentBase::ClearFromGC();
     }
   }
 
+  // See Get() for details.
+  V8_CLANG_NO_SANITIZE("cfi-unrelated-cast")
+  T* GetFromGC() const {
+    return static_cast<T*>(const_cast<void*>(GetValueFromGC()));
+  }
+
   friend class cppgc::Visitor;
 };