chore: cherry-pick ec6c18478382 from v8 (#48337)

* chore: cherry-pick ec6c18478382 from v8

* chore: update patches

* chore: update patches post-rebase

.github/actions/build-electron/action.yml

@@ -44,6 +44,14 @@ runs:
     - name: Add Clang problem matcher
       shell: bash
       run: echo "::add-matcher::src/electron/.github/problem-matchers/clang.json"
+    - name: Setup Siso for fork pull requests
+      if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+      shell: bash
+      run: |
+        # Use Local Execution, Remote Caching (LERC). Checks the remote cache for action
+        # matches and uses existing results if a match is found. If not, execution of the
+        # action is performed locally.
+        echo "RBE_exec_strategy=local" >> $GITHUB_ENV
     - name: Build Electron ${{ inputs.step-suffix }}
       shell: bash
       run: |

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '140.0.7339.80',
+    '140.0.7339.133',
   'node_version':
     'v22.19.0',
   'nan_version':

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -46,10 +46,10 @@ index 42292200196b51af4dc57e95f65876761bf6b892..ba90ea9e26330b4becf7931ec2421beb
        # than here in :chrome_dll.
        deps += [ "//chrome:packed_resources_integrity_header" ]
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index 6d3d642367280e4bc0d3a9e5ee68dca5a5c92f16..244abec3d9a1758d78590f0f45b8af40615638e7 100644
+index 572de58b1cb6b643cdcc73509685eb4f615bd39e..b26a87e617c14f80652b7daaa57ada59740e3bcd 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7447,9 +7447,12 @@ test("unit_tests") {
+@@ -7449,9 +7449,12 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -63,7 +63,7 @@ index 6d3d642367280e4bc0d3a9e5ee68dca5a5c92f16..244abec3d9a1758d78590f0f45b8af40
        "//chrome//services/util_win:unit_tests",
        "//chrome/app:chrome_dll_resources",
        "//chrome/app:win_unit_tests",
-@@ -8386,6 +8389,10 @@ test("unit_tests") {
+@@ -8389,6 +8392,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -74,7 +74,7 @@ index 6d3d642367280e4bc0d3a9e5ee68dca5a5c92f16..244abec3d9a1758d78590f0f45b8af40
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8442,7 +8449,6 @@ test("unit_tests") {
+@@ -8445,7 +8452,6 @@ test("unit_tests") {
      # TODO(crbug.com/417513088): Maybe merge with the non-android `deps` declaration above?
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -312,7 +312,7 @@ index 7e3d46902fbf736b4240eb3fcb89975a7b222197..57fdc89fc265ad70cb0bff8443cc1026
  
    auto DrawAsSinglePath = [&]() {
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-index f4784c62cca71fe5f6334d53336db530d6f313b0..ae17298da83ed8fcb505e5f9e07f682a4624ff13 100644
+index 485025e439a90fef0c333c75477011670f4cd6ae..db4ff90eaae7ac0e22d56536fb45f18aca98e7cf 100644
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 @@ -214,6 +214,10 @@

patches/v8/.patches

@@ -1 +1,2 @@
 chore_allow_customizing_microtask_policy_per_context.patch
+cherry-pick-ec6c18478382.patch

patches/v8/cherry-pick-ec6c18478382.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Darius Mercadier <dmercadier@chromium.org>
+Date: Tue, 16 Sep 2025 16:40:24 +0200
+Subject: Don't assume that upper 32-bit of Int32MulOvfCheck are 0
+
+Because Arm64 doesn't have a flag-setting 32-bit multiplication,
+which means that instead with use a 64-bit multiplication, and compare
+result.X() and result.W() to check if an overflow happened. But this
+leads to the upper 32-bit not being zeroed.
+
+Fixed: 445380761
+Change-Id: I31287faf37dc615695047021324e9d1d802cbec2
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6954290
+Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
+Commit-Queue: Leszek Swirski <leszeks@chromium.org>
+Reviewed-by: Leszek Swirski <leszeks@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#102530}
+
+diff --git a/src/compiler/backend/arm64/instruction-selector-arm64.cc b/src/compiler/backend/arm64/instruction-selector-arm64.cc
+index 60ff1ee97931edfcca28b6f5f7c4918d015af974..0212f4570750599bc266a1cd8c9efa19ea26e85c 100644
+--- a/src/compiler/backend/arm64/instruction-selector-arm64.cc
++++ b/src/compiler/backend/arm64/instruction-selector-arm64.cc
+@@ -2958,9 +2958,19 @@ bool InstructionSelector::ZeroExtendsWord32ToWord64NoPhis(OpIndex node) {
+       return op.Cast<ShiftOp>().rep == WordRepresentation::Word32();
+     case Opcode::kComparison:
+       return op.Cast<ComparisonOp>().rep == RegisterRepresentation::Word32();
+-    case Opcode::kOverflowCheckedBinop:
+-      return op.Cast<OverflowCheckedBinopOp>().rep ==
+-             WordRepresentation::Word32();
++    case Opcode::kOverflowCheckedBinop: {
++      const OverflowCheckedBinopOp& binop = op.Cast<OverflowCheckedBinopOp>();
++      if (binop.rep != WordRepresentation::Word32()) return false;
++      switch (binop.kind) {
++        case OverflowCheckedBinopOp::Kind::kSignedAdd:
++        case OverflowCheckedBinopOp::Kind::kSignedSub:
++          return true;
++        case OverflowCheckedBinopOp::Kind::kSignedMul:
++          // EmitInt32MulWithOverflow doesn't zero-extend because Arm64 doesn't
++          // have a flag-setting int32 multiplication.
++          return false;
++      }
++    }
+     case Opcode::kProjection:
+       return ZeroExtendsWord32ToWord64NoPhis(op.Cast<ProjectionOp>().input());
+     case Opcode::kLoad: {