[cppgc-js] Reuse stack object from V8

Reuse the stack object that V8 maintains via ThreadLocalTop for
CppHeap.  This allows CppHeap to be migrated across threads, similar
to Isolate, when used with Locker.

Bug: v8:13207
Change-Id: I4c865f4eeb79257ed720cf46e42b27589fcf555e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4013799
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84126}

include/cppgc/README.md

@@ -26,6 +26,8 @@ This allows Oilpan to run garbage collection in parallel with mutators running i
 References to objects belonging to another thread's heap are modeled using cross-thread roots.
 This is even true for on-heap to on-heap references.
 
+Oilpan heaps may generally not be accessed from different threads unless otherwise noted.
+
 ## Heap partitioning
 
 Oilpan's heaps are partitioned into spaces.

include/v8-cppgc.h

@@ -95,6 +95,10 @@ struct V8_EXPORT CppHeapCreateParams {
 
 /**
  * A heap for allocating managed C++ objects.
+ *
+ * Similar to v8::Isolate, the heap may only be accessed from one thread at a
+ * time. The heap may be used from different threads using the
+ * v8::Locker/v8::Unlocker APIs which is different from generic Oilpan.
  */
 class V8_EXPORT CppHeap {
  public:

include/v8-isolate.h

@@ -954,22 +954,20 @@ class V8_EXPORT Isolate {
    * Attaches a managed C++ heap as an extension to the JavaScript heap. The
    * embedder maintains ownership of the CppHeap. At most one C++ heap can be
    * attached to V8.
+   *
    * AttachCppHeap cannot be used simultaneously with SetEmbedderHeapTracer.
    *
-   * This is an experimental feature and may still change significantly.
+   * Multi-threaded use requires the use of v8::Locker/v8::Unlocker, see
+   * CppHeap.
    */
   void AttachCppHeap(CppHeap*);
 
   /**
    * Detaches a managed C++ heap if one was attached using `AttachCppHeap()`.
-   *
-   * This is an experimental feature and may still change significantly.
    */
   void DetachCppHeap();
 
   /**
-   * This is an experimental feature and may still change significantly.
-
    * \returns the C++ heap managed by V8. Only available if such a heap has been
    *   attached using `AttachCppHeap()`.
    */

src/heap/cppgc-js/cpp-heap.cc

@@ -638,6 +638,10 @@ void CppHeap::DetachIsolate() {
   no_gc_scope_++;
 }
 
+::heap::base::Stack* CppHeap::stack() {
+  return isolate_ ? &isolate_->heap()->stack() : HeapBase::stack();
+}
+
 namespace {
 
 bool IsMemoryReducingGC(CppHeap::GarbageCollectionFlags flags) {

src/heap/cppgc-js/cpp-heap.h

@@ -162,6 +162,8 @@ class V8_EXPORT_PRIVATE CppHeap final
 
   Isolate* isolate() const { return isolate_; }
 
+  ::heap::base::Stack* stack() final;
+
   std::unique_ptr<CppMarkingState> CreateCppMarkingState();
   std::unique_ptr<CppMarkingState> CreateCppMarkingStateForMutatorThread();
 

src/heap/cppgc/heap-base.h

@@ -108,8 +108,6 @@ class V8_EXPORT_PRIVATE HeapBase : public cppgc::HeapHandle {
     return stats_collector_.get();
   }
 
-  heap::base::Stack* stack() { return stack_.get(); }
-
   PreFinalizerHandler* prefinalizer_handler() {
     return prefinalizer_handler_.get();
   }
@@ -161,6 +159,8 @@ class V8_EXPORT_PRIVATE HeapBase : public cppgc::HeapHandle {
 
   size_t ObjectPayloadSize() const;
 
+  virtual heap::base::Stack* stack() { return stack_.get(); }
+
   StackSupport stack_support() const { return stack_support_; }
   const EmbedderStackState* override_stack_state() const {
     return override_stack_state_.get();