deps: update V8 to 11.9.169.7

PR-URL: #50115
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>

Author: targos

deps/v8/.gitignore

@@ -51,7 +51,7 @@
 /src/inspector/build/closure-compiler
 /src/inspector/build/closure-compiler.tar.gz
 /test/benchmarks/data
-/test/fuzzer/wasm_corpus
+/test/fuzzer/wasm_corpus/
 /test/fuzzer/wasm_corpus.tar.gz
 !/test/mjsunit/tools/*.log
 /test/mozilla/data

deps/v8/.gn

@@ -25,10 +25,6 @@ no_check_targets = [
 ]
 
 default_args = {
-  # Overwrite default args declared in the Fuchsia sdk
-  # Please maintain this in sync with Chromium version in src/.gn
-  fuchsia_target_api_level = 9
-
   # Disable rust dependencies.
   enable_rust = false
 }

deps/v8/AUTHORS

@@ -177,8 +177,8 @@ Kris Selden <[email protected]>
 Kyounga Ra <[email protected]>
 Loo Rong Jie <[email protected]>
 Lu Yahan <[email protected]>
+Ludovic Mermod <[email protected]>
 Luis Reis <[email protected]>
-Luke Albao <[email protected]>
 Luke Zarko <[email protected]>
 Ma Aiguo <[email protected]>
 Maciej Małecki <[email protected]>

deps/v8/BUILD.bazel

@@ -829,6 +829,7 @@ filegroup(
         "src/builtins/array-findlastindex.tq",
         "src/builtins/array-foreach.tq",
         "src/builtins/array-from.tq",
+        "src/builtins/array-from-async.tq",
         "src/builtins/array-isarray.tq",
         "src/builtins/array-join.tq",
         "src/builtins/array-lastindexof.tq",
@@ -1010,6 +1011,7 @@ filegroup(
         "src/objects/name.tq",
         "src/objects/oddball.tq",
         "src/objects/hole.tq",
+        "src/objects/trusted-object.tq",
         "src/objects/ordered-hash-table.tq",
         "src/objects/primitive-heap-object.tq",
         "src/objects/promise.tq",
@@ -1516,6 +1518,7 @@ filegroup(
         "src/heap/cppgc-js/wrappable-info-inl.h",
         "src/heap/ephemeron-remembered-set.h",
         "src/heap/ephemeron-remembered-set.cc",
+        "src/heap/evacuation-allocator.cc",
         "src/heap/evacuation-allocator.h",
         "src/heap/evacuation-allocator-inl.h",
         "src/heap/evacuation-verifier.cc",
@@ -1572,6 +1575,9 @@ filegroup(
         "src/heap/local-heap.cc",
         "src/heap/local-heap.h",
         "src/heap/local-heap-inl.h",
+        "src/heap/main-allocator.cc",
+        "src/heap/main-allocator.h",
+        "src/heap/main-allocator-inl.h",
         "src/heap/mark-compact.cc",
         "src/heap/mark-compact.h",
         "src/heap/mark-compact-inl.h",
@@ -1945,6 +1951,8 @@ filegroup(
         "src/objects/oddball.h",
         "src/objects/oddball-inl.h",
         "src/objects/hole.h",
+        "src/objects/trusted-object.h",
+        "src/objects/trusted-object-inl.h",
         "src/objects/hole-inl.h",
         "src/objects/option-utils.cc",
         "src/objects/option-utils.h",
@@ -2197,9 +2205,13 @@ filegroup(
         "src/sandbox/code-pointer-table.cc",
         "src/sandbox/code-pointer-table.h",
         "src/sandbox/code-pointer-table-inl.h",
+        "src/sandbox/indirect-pointer-table.cc",
+        "src/sandbox/indirect-pointer-table.h",
+        "src/sandbox/indirect-pointer-table-inl.h",
         "src/sandbox/code-pointer.h",
         "src/sandbox/code-pointer-inl.h",
         "src/sandbox/indirect-pointer.h",
+        "src/sandbox/indirect-pointer-tag.h",
         "src/sandbox/indirect-pointer-inl.h",
         "src/sandbox/external-entity-table.h",
         "src/sandbox/external-entity-table-inl.h",
@@ -2578,6 +2590,8 @@ filegroup(
             "src/asmjs/asm-scanner.h",
             "src/asmjs/asm-types.cc",
             "src/asmjs/asm-types.h",
+            "src/compiler/turboshaft/wasm-dead-code-elimination-phase.cc",
+            "src/compiler/turboshaft/wasm-dead-code-elimination-phase.h",
             "src/debug/debug-wasm-objects.cc",
             "src/debug/debug-wasm-objects.h",
             "src/debug/debug-wasm-objects-inl.h",
@@ -2650,6 +2664,7 @@ filegroup(
             "src/wasm/value-type.cc",
             "src/wasm/value-type.h",
             "src/wasm/wasm-arguments.h",
+            "src/wasm/wasm-builtin-list.h",
             "src/wasm/wasm-code-manager.cc",
             "src/wasm/wasm-code-manager.h",
             "src/wasm/wasm-debug.cc",
@@ -3020,6 +3035,10 @@ filegroup(
         "src/compiler/turboshaft/late-load-elimination-reducer.cc",
         "src/compiler/turboshaft/late-load-elimination-reducer.h",
         "src/compiler/turboshaft/layered-hash-map.h",
+        "src/compiler/turboshaft/loop-unrolling-phase.cc",
+        "src/compiler/turboshaft/loop-unrolling-phase.h",
+        "src/compiler/turboshaft/loop-unrolling-reducer.cc",
+        "src/compiler/turboshaft/loop-unrolling-reducer.h",
         "src/compiler/turboshaft/machine-lowering-phase.cc",
         "src/compiler/turboshaft/machine-lowering-phase.h",
         "src/compiler/turboshaft/machine-lowering-reducer.h",
@@ -3052,6 +3071,8 @@ filegroup(
         "src/compiler/turboshaft/simplify-tf-loops.cc",
         "src/compiler/turboshaft/simplify-tf-loops.h",
         "src/compiler/turboshaft/snapshot-table.h",
+        "src/compiler/turboshaft/snapshot-table-opindex.h",
+        "src/compiler/turboshaft/stack-check-reducer.h",
         "src/compiler/turboshaft/store-store-elimination-phase.cc",
         "src/compiler/turboshaft/store-store-elimination-phase.h",
         "src/compiler/turboshaft/store-store-elimination-reducer.h",
@@ -3158,6 +3179,10 @@ filegroup(
             "src/compiler/turboshaft/int64-lowering-phase.h",
             "src/compiler/turboshaft/int64-lowering-reducer.h",
             "src/compiler/turboshaft/wasm-lowering-reducer.h",
+            "src/compiler/turboshaft/wasm-gc-optimize-phase.cc",
+            "src/compiler/turboshaft/wasm-gc-optimize-phase.h",
+            "src/compiler/turboshaft/wasm-gc-type-reducer.cc",
+            "src/compiler/turboshaft/wasm-gc-type-reducer.h",
             "src/compiler/turboshaft/wasm-optimize-phase.cc",
             "src/compiler/turboshaft/wasm-optimize-phase.h",
             "src/compiler/turboshaft/wasm-turboshaft-compiler.cc",
@@ -3401,6 +3426,8 @@ filegroup(
         "src/heap/base/bytes.h",
         "src/heap/base/incremental-marking-schedule.cc",
         "src/heap/base/incremental-marking-schedule.h",
+        "src/heap/base/memory-tagging.h",
+        "src/heap/base/memory-tagging.cc",
         "src/heap/base/stack.cc",
         "src/heap/base/stack.h",
         "src/heap/base/worklist.cc",

deps/v8/BUILD.gn

@@ -337,10 +337,6 @@ declare_args() {
   # Sets -DV8_ENABLE_SANDBOX.
   v8_enable_sandbox = ""
 
-  # Enable experimental code pointer sandboxing for the V8 sandbox.
-  # Sets -DV8_CODE_POINTER_SANDBOXING
-  v8_code_pointer_sandboxing = ""
-
   # Expose the memory corruption API to JavaScript. Useful for testing the sandbox.
   # WARNING This will expose builtins that (by design) cause memory corruption.
   # Sets -DV8_EXPOSE_MEMORY_CORRUPTION_API
@@ -568,11 +564,6 @@ if (v8_enable_sandbox == "") {
                       v8_enable_external_code_space && target_os != "fuchsia"
 }
 
-if (v8_code_pointer_sandboxing == "") {
-  # By default, enable code pointer sandboxing if the sandbox is enabled.
-  v8_code_pointer_sandboxing = v8_enable_sandbox
-}
-
 if (v8_enable_static_roots == "") {
   # Static roots are only valid for builds with pointer compression and a
   # shared read-only heap.
@@ -674,8 +665,8 @@ assert(!v8_enable_sandbox || v8_enable_pointer_compression_shared_cage,
 assert(!v8_enable_sandbox || v8_enable_external_code_space,
        "The sandbox requires the external code space")
 
-assert(!v8_code_pointer_sandboxing || v8_enable_sandbox,
-       "Code pointer sandboxing requires the sandbox")
+assert(!v8_enable_sandbox || !v8_enable_third_party_heap,
+       "The sandbox is incompatible with the third-party heap")
 
 assert(!v8_expose_memory_corruption_api || v8_enable_sandbox,
        "The Memory Corruption API requires the sandbox")
@@ -769,7 +760,7 @@ config("internal_config") {
 config("v8_tracing_config") {
   if (v8_use_perfetto) {
     include_dirs = [
-      "third_party/perfetto/include",
+      "//third_party/perfetto/include",
       "$root_gen_dir/third_party/perfetto",
       "$root_gen_dir/third_party/perfetto/build_config",
     ]
@@ -1210,9 +1201,6 @@ config("features") {
   if (v8_enable_wasm_simd256_revec) {
     defines += [ "V8_ENABLE_WASM_SIMD256_REVEC" ]
   }
-  if (v8_code_pointer_sandboxing) {
-    defines += [ "V8_CODE_POINTER_SANDBOXING" ]
-  }
   if (v8_enable_maglev_graph_printer) {
     defines += [ "V8_ENABLE_MAGLEV_GRAPH_PRINTER" ]
   }
@@ -1842,6 +1830,7 @@ torque_files = [
   "src/builtins/array-findlast.tq",
   "src/builtins/array-findlastindex.tq",
   "src/builtins/array-foreach.tq",
+  "src/builtins/array-from-async.tq",
   "src/builtins/array-from.tq",
   "src/builtins/array-isarray.tq",
   "src/builtins/array-join.tq",
@@ -2025,6 +2014,7 @@ torque_files = [
   "src/objects/name.tq",
   "src/objects/oddball.tq",
   "src/objects/hole.tq",
+  "src/objects/trusted-object.tq",
   "src/objects/ordered-hash-table.tq",
   "src/objects/primitive-heap-object.tq",
   "src/objects/promise.tq",
@@ -3332,6 +3322,8 @@ v8_header_set("v8_internal_headers") {
     "src/compiler/turboshaft/late-escape-analysis-reducer.h",
     "src/compiler/turboshaft/late-load-elimination-reducer.h",
     "src/compiler/turboshaft/layered-hash-map.h",
+    "src/compiler/turboshaft/loop-unrolling-phase.h",
+    "src/compiler/turboshaft/loop-unrolling-reducer.h",
     "src/compiler/turboshaft/machine-lowering-phase.h",
     "src/compiler/turboshaft/machine-lowering-reducer.h",
     "src/compiler/turboshaft/machine-optimization-reducer.h",
@@ -3352,7 +3344,9 @@ v8_header_set("v8_internal_headers") {
     "src/compiler/turboshaft/select-lowering-reducer.h",
     "src/compiler/turboshaft/sidetable.h",
     "src/compiler/turboshaft/simplify-tf-loops.h",
+    "src/compiler/turboshaft/snapshot-table-opindex.h",
     "src/compiler/turboshaft/snapshot-table.h",
+    "src/compiler/turboshaft/stack-check-reducer.h",
     "src/compiler/turboshaft/store-store-elimination-phase.h",
     "src/compiler/turboshaft/store-store-elimination-reducer.h",
     "src/compiler/turboshaft/structural-optimization-reducer.h",
@@ -3371,6 +3365,7 @@ v8_header_set("v8_internal_headers") {
     "src/compiler/turboshaft/utils.h",
     "src/compiler/turboshaft/value-numbering-reducer.h",
     "src/compiler/turboshaft/variable-reducer.h",
+    "src/compiler/turboshaft/wasm-dead-code-elimination-phase.h",
     "src/compiler/type-cache.h",
     "src/compiler/type-narrowing-reducer.h",
     "src/compiler/typed-optimization.h",
@@ -3523,6 +3518,8 @@ v8_header_set("v8_internal_headers") {
     "src/heap/local-factory.h",
     "src/heap/local-heap-inl.h",
     "src/heap/local-heap.h",
+    "src/heap/main-allocator-inl.h",
+    "src/heap/main-allocator.h",
     "src/heap/mark-compact-inl.h",
     "src/heap/mark-compact.h",
     "src/heap/mark-sweep-utilities.h",
@@ -3844,6 +3841,8 @@ v8_header_set("v8_internal_headers") {
     "src/objects/torque-defined-classes.h",
     "src/objects/transitions-inl.h",
     "src/objects/transitions.h",
+    "src/objects/trusted-object-inl.h",
+    "src/objects/trusted-object.h",
     "src/objects/turbofan-types-inl.h",
     "src/objects/turbofan-types.h",
     "src/objects/turboshaft-types-inl.h",
@@ -3931,6 +3930,9 @@ v8_header_set("v8_internal_headers") {
     "src/sandbox/external-pointer-table.h",
     "src/sandbox/external-pointer.h",
     "src/sandbox/indirect-pointer-inl.h",
+    "src/sandbox/indirect-pointer-table-inl.h",
+    "src/sandbox/indirect-pointer-table.h",
+    "src/sandbox/indirect-pointer-tag.h",
     "src/sandbox/indirect-pointer.h",
     "src/sandbox/sandbox.h",
     "src/sandbox/sandboxed-pointer-inl.h",
@@ -4071,6 +4073,8 @@ v8_header_set("v8_internal_headers") {
       "src/compiler/int64-lowering.h",
       "src/compiler/turboshaft/int64-lowering-phase.h",
       "src/compiler/turboshaft/int64-lowering-reducer.h",
+      "src/compiler/turboshaft/wasm-gc-optimize-phase.h",
+      "src/compiler/turboshaft/wasm-gc-type-reducer.h",
       "src/compiler/turboshaft/wasm-js-lowering-reducer.h",
       "src/compiler/turboshaft/wasm-lowering-reducer.h",
       "src/compiler/turboshaft/wasm-optimize-phase.h",
@@ -4130,6 +4134,7 @@ v8_header_set("v8_internal_headers") {
       "src/wasm/turboshaft-graph-interface.h",
       "src/wasm/value-type.h",
       "src/wasm/wasm-arguments.h",
+      "src/wasm/wasm-builtin-list.h",
       "src/wasm/wasm-code-manager.h",
       "src/wasm/wasm-debug.h",
       "src/wasm/wasm-disassembler-impl.h",
@@ -4379,6 +4384,17 @@ v8_header_set("v8_internal_headers") {
       "src/regexp/loong64/regexp-macro-assembler-loong64.h",
       "src/wasm/baseline/loong64/liftoff-assembler-loong64.h",
     ]
+    if (v8_enable_webassembly) {
+      # Trap handling is enabled on loong64 Linux and in simulators on
+      # x64 on Linux.
+      if ((current_cpu == "loong64" && is_linux) ||
+          (current_cpu == "x64" && is_linux)) {
+        sources += [ "src/trap-handler/handler-inside-posix.h" ]
+      }
+      if (current_cpu == "x64" && is_linux) {
+        sources += [ "src/trap-handler/trap-handler-simulator.h" ]
+      }
+    }
   } else if (v8_current_cpu == "ppc") {
     sources += [
       ### gcmole(ppc) ###
@@ -4738,6 +4754,8 @@ if (v8_enable_webassembly) {
   v8_compiler_sources += [
     "src/compiler/int64-lowering.cc",
     "src/compiler/turboshaft/int64-lowering-phase.cc",
+    "src/compiler/turboshaft/wasm-gc-optimize-phase.cc",
+    "src/compiler/turboshaft/wasm-gc-type-reducer.cc",
     "src/compiler/turboshaft/wasm-optimize-phase.cc",
     "src/compiler/turboshaft/wasm-turboshaft-compiler.cc",
     "src/compiler/wasm-address-reassociation.cc",
@@ -4847,6 +4865,8 @@ v8_source_set("v8_turboshaft") {
     "src/compiler/turboshaft/instruction-selection-phase.cc",
     "src/compiler/turboshaft/late-escape-analysis-reducer.cc",
     "src/compiler/turboshaft/late-load-elimination-reducer.cc",
+    "src/compiler/turboshaft/loop-unrolling-phase.cc",
+    "src/compiler/turboshaft/loop-unrolling-reducer.cc",
     "src/compiler/turboshaft/machine-lowering-phase.cc",
     "src/compiler/turboshaft/memory-optimization-reducer.cc",
     "src/compiler/turboshaft/operations.cc",
@@ -5082,6 +5102,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/cppgc-js/unified-heap-marking-verifier.cc",
     "src/heap/cppgc-js/unified-heap-marking-visitor.cc",
     "src/heap/ephemeron-remembered-set.cc",
+    "src/heap/evacuation-allocator.cc",
     "src/heap/evacuation-verifier.cc",
     "src/heap/factory-base.cc",
     "src/heap/factory.cc",
@@ -5102,6 +5123,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/heap/large-spaces.cc",
     "src/heap/local-factory.cc",
     "src/heap/local-heap.cc",
+    "src/heap/main-allocator.cc",
     "src/heap/mark-compact.cc",
     "src/heap/mark-sweep-utilities.cc",
     "src/heap/marking-barrier.cc",
@@ -5327,6 +5349,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/runtime/runtime.cc",
     "src/sandbox/code-pointer-table.cc",
     "src/sandbox/external-pointer-table.cc",
+    "src/sandbox/indirect-pointer-table.cc",
     "src/sandbox/sandbox.cc",
     "src/sandbox/testing.cc",
     "src/snapshot/code-serializer.cc",
@@ -5427,6 +5450,7 @@ v8_source_set("v8_base_without_compiler") {
       "src/asmjs/asm-parser.cc",
       "src/asmjs/asm-scanner.cc",
       "src/asmjs/asm-types.cc",
+      "src/compiler/turboshaft/wasm-dead-code-elimination-phase.cc",
       "src/debug/debug-wasm-objects.cc",
       "src/runtime/runtime-test-wasm.cc",
       "src/runtime/runtime-wasm.cc",
@@ -5640,6 +5664,20 @@ v8_source_set("v8_base_without_compiler") {
       "src/execution/loong64/simulator-loong64.cc",
       "src/regexp/loong64/regexp-macro-assembler-loong64.cc",
     ]
+    if (v8_enable_webassembly) {
+      # Trap handling is enabled on loong64 Linux and in simulators on
+      # x64 on Linux.
+      if ((current_cpu == "loong64" && is_linux) ||
+          (current_cpu == "x64" && is_linux)) {
+        sources += [
+          "src/trap-handler/handler-inside-posix.cc",
+          "src/trap-handler/handler-outside-posix.cc",
+        ]
+      }
+      if (current_cpu == "x64" && is_linux) {
+        sources += [ "src/trap-handler/handler-outside-simulator.cc" ]
+      }
+    }
   } else if (v8_current_cpu == "ppc") {
     sources += [
       ### gcmole(ppc) ###
@@ -6391,6 +6429,7 @@ v8_header_set("v8_heap_base_headers") {
     "src/heap/base/basic-slot-set.h",
     "src/heap/base/bytes.h",
     "src/heap/base/incremental-marking-schedule.h",
+    "src/heap/base/memory-tagging.h",
     "src/heap/base/stack.h",
     "src/heap/base/worklist.h",
   ]
@@ -6404,6 +6443,7 @@ v8_source_set("v8_heap_base") {
   sources = [
     "src/heap/base/active-system-pages.cc",
     "src/heap/base/incremental-marking-schedule.cc",
+    "src/heap/base/memory-tagging.cc",
     "src/heap/base/stack.cc",
     "src/heap/base/worklist.cc",
   ]
@@ -6440,6 +6480,8 @@ v8_source_set("v8_heap_base") {
 
   configs = [ ":internal_config" ]
 
+  deps = [ ":v8_config_headers" ]
+
   public_deps = [
     ":v8_heap_base_headers",
     ":v8_libbase",