feat: fully JITless by default with working bypass

build/chromium.conf

@@ -67,4 +67,4 @@ if ! command -v nvidia-smi || [ -z "$DISPLAY" ]; then
    CHROMIUM_FLAGS+=" --ozone-platform-hint=auto"
 fi
 
-CHROMIUM_FLAGS+=" --disable-breakpad"
+CHROMIUM_FLAGS+=" --disable-breakpad --js-flags=--jitless"

patches/allow-global-jit-bypass.patch

@@ -0,0 +1,15 @@
+diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
+index ba9f41f010a37..97e0c8fb83ecb 100644
+--- a/content/browser/renderer_host/render_process_host_impl.cc
++++ b/content/browser/renderer_host/render_process_host_impl.cc
+@@ -3192,6 +3192,10 @@ void RenderProcessHostImpl::AppendRendererCommandLine(
+   } else if (AreV8OptimizationsDisabled()) {
+     command_line->AppendSwitchASCII(blink::switches::kJavaScriptFlags,
+                                     "--disable-optimizing-compilers");
++  } else {
++    // Allow for per-site exceptions even when JIT is globally disabled,
++    // the "dummy value" here allows the override
++    command_line->AppendSwitchASCII(blink::switches::kJavaScriptFlags, "");
+   }
+
+   if (features::IsTouchTextEditingRedesignEnabled()) {

patches/expose-flags.patch

@@ -2,7 +2,7 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 index 9d0181f447a1a..f362603d31caf 100644
 --- a/chrome/browser/about_flags.cc
 +++ b/chrome/browser/about_flags.cc
-@@ -4220,6 +4220,41 @@ const FeatureEntry kFeatureEntries[] = {
+@@ -4220,6 +4220,35 @@ const FeatureEntry kFeatureEntries[] = {
  // //tools/flags/generate_unexpire_flags.py.
  #include "build/chromeos_buildflags.h"
  #include "chrome/browser/unexpire_flags_gen.inc"
@@ -13,12 +13,6 @@ index 9d0181f447a1a..f362603d31caf 100644
 +    {"extensions-support", "Extensions Support",
 +     "Toggle extensions support. This switch is exposed by hardened-chromium.",
 +     kOsAll, SINGLE_DISABLE_VALUE_TYPE(switches::kDisableExtensions)},
-+    {"disable-v8-jit-globally", "Disable V8 JIT Globally",
-+     "Disable V8 JIT for JavaScript and Webassembly on all pages. "
-+     "The V8 optimizations toggle in preferences only affects webpages. "
-+     "This switch is exposed by hardened-chromium", kOsAll,
-+     SINGLE_VALUE_TYPE_AND_VALUE(blink::switches::kJavaScriptFlags,
-+                                         "--jitless")},
 +    {"disable-cross-origin-referrers", "Clear cross-origin referrers",
 +     "Clears referrers when navigating across origins. Defaults to disabled. "
 +     "This feature is provided by hardened-chromium.", kOsAll,