diff --git a/v8/src/maglev/maglev-graph-builder.cc b/v8/src/maglev/maglev-graph-builder.cc index 81afa73b592..bandaidfix000 100644 --- a/v8/src/maglev/maglev-graph-builder.cc +++ b/v8/src/maglev/maglev-graph-builder.cc @@ -17652,6 +17652,15 @@ std::optional MaglevGraphBuilder::TryGetFloat64OrHoleyFloat64Constant( MaybeHandle MaglevGraphBuilder::TryGetStringConstant(ValueNode* value) { if (Constant* constant = value->TryCast()) { if (constant->object().IsString()) { + // The caller (BuildStringConcat) reads the string's characters via + // ConcatenateStrings -> String::WriteToFlat on a background compiler + // thread. Gate on IsContentAccessible() so that uncached, non-cacheable + // ExternalStrings (e.g. SlicedString over a Blink ParkableString-backed + // Script::source()) are not read concurrently without resource->Lock(). + // Mirrors JSNativeContextSpecialization::StringCanSafelyBeRead. + if (!constant->object().AsString().IsContentAccessible()) { + return {}; + } return handle(Cast(*constant->object().object()), local_isolate()); }