From 69c6070601652ef95db943871f2a8d6f1e665bce Mon Sep 17 00:00:00 2001
From: eliau2005 <eliau.elkouby@gmail.com>
Date: Thu, 29 Oct 2026 22:57:58 +0200
Subject: [PATCH 1/2] deps: V8: backport 5ba8aab1ec1b

Original commit message:

    Reland "[parser] Create debug magic comment values as source substrings"

    This is a reland of commit 8dcf14f490c20b23b90f9f4af56d52abdd933a0c

    Changes since the original:

    The original made every value with at least SlicedString::kMinLength
    characters a SlicedString of the source, including usual source URLs
    like //# sourceURL=inside-direct-eval.js. Heap snapshots name sliced
    strings "(sliced string)" instead of by their contents, so DevTools'
    heap snapshot ContextAnalyzer, which reads the name of the script's
    source_url node, showed "(sliced string)" instead of the source URL.

    The source URL is now always a sequential copy of its value, as
    before the original (which internalized it), since it is used as the
    script name (stack traces, profiles, heap snapshots). The debug ID is
    also copied, since it is short. Only the sourceMappingURL value is a
    substring of the source, which covers the case the original was about
    (huge inline source maps). A huge sourceURL or debugId value is copied
    onto the heap as before the original.

    Added a regression test that a source URL longer than
    SlicedString::kMinLength is sequential (script, streaming and direct
    eval) and that heap snapshots name the source_url node by it, and
    updated the existing tests accordingly.

    Original change's description:
    > [parser] Create debug magic comment values as source substrings
    >
    > The values of the //# sourceURL, sourceMappingURL and debugId magic
    > comments were copied into LiteralBuffers while scanning and then
    > internalized. An inline source map (sourceMappingURL=data:...) can be
    > tens of MiB, so this allocated a string of that size on the heap in a
    > non-throwing allocation, e.g. aborting a Node.js worker with a small
    > old-generation limit even though the (external) source fits.
    >
    > The scanner now only records the source locations of these values, and
    > the values are created as substrings of the script source:
    > - On the main thread, when parsing finishes.
    > - For background and streaming compiles, where the source is not
    >   available while parsing, the locations are kept in the
    >   BackgroundCompileTask and the substrings are created in
    >   FinalizeScript after the source is set. Locations outside of the
    >   source provided by the embedder are ignored.
    >
    > The semantics are unchanged: the last comment wins, trailing garbage or
    > an empty value removes the value, and a source map URL provided through
    > the API takes precedence.
    >
    > Since these values are now usually SlicedStrings of the script source,
    > the code serializer serializes all sliced strings as sequential
    > strings (one-byte if their contents are, even if their parent is
    > two-byte). The script source is an attached object, and off-thread
    > deserialization attaches a placeholder for it, so a serialized slice
    > of it would not be valid.
    >
    > Consuming a code cache still materializes these values as sequential
    > strings, e.g. on Node.js's NODE_COMPILE_CACHE path, so a huge cached
    > value can still be large on the heap there. Keeping them as substrings
    > of the source when deserializing requires a code cache format change
    > and is left for a follow-up.
    >
    > This also removes the LiteralBuffer copies of the values.
    >
    > R=leszeks@chromium.org, verwaest@chromium.org
    >
    > Bug: 566467883
    > Refs: https://github.com/nodejs/node/issues/64155
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8472768
    > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    > Reviewed-by: Patrick Thier <pthier@chromium.org>
    > Cr-Commit-Position: refs/heads/main@{#110612}

    R=leszeks@chromium.org, verwaest@chromium.org, pthier@chromium.org

    Bug: 566467883
    Change-Id: I76eec1fdaf71526afdd881d0d4a2b117c32d3ba8
    Refs: https://github.com/nodejs/node/issues/64155
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8579167
    Reviewed-by: Patrick Thier <pthier@chromium.org>
    Commit-Queue: Patrick Thier <pthier@chromium.org>
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#111132}

Adapted to deps/v8: this also includes the upstream refactor
b0f6ad031f03 ("[parser] Factor magic comment value scanning into a
helper"), which the reland is based on. src/base/unique-array.h does
not exist yet, so base::OwnedVector is used in the serializer, the
serializer keeps the 15.6 external string handling (without the later
SBXCHECK hardening), and the CodeSerializer override is placed for the
older class layout. The inspector test is not included because
deps/v8 does not ship test/inspector.

Refs: https://github.com/v8/v8/commit/5ba8aab1ec1bf4376a16fa263be52e8752bbc761
Refs: https://github.com/v8/v8/commit/b0f6ad031f0303f279663760d3dd998a5e061e54
Signed-off-by: eliau2005 <eliau.elkouby@gmail.com>
---
 common.gypi                                   |   2 +-
 deps/v8/src/codegen/compiler.cc               |  11 +-
 deps/v8/src/codegen/compiler.h                |   4 +
 deps/v8/src/parsing/literal-buffer.cc         |  18 -
 deps/v8/src/parsing/literal-buffer.h          |   3 -
 deps/v8/src/parsing/parser.cc                 |  52 ++-
 deps/v8/src/parsing/parser.h                  |  15 +-
 deps/v8/src/parsing/scanner.cc                | 116 +++---
 deps/v8/src/parsing/scanner.h                 |  29 +-
 deps/v8/src/snapshot/code-serializer.h        |   6 +
 deps/v8/src/snapshot/serializer.cc            |  56 ++-
 deps/v8/src/snapshot/serializer.h             |   7 +
 deps/v8/test/cctest/cctest.h                  |   4 +-
 deps/v8/test/cctest/test-api.cc               | 372 ++++++++++++++++++
 deps/v8/test/cctest/test-heap-profiler.cc     |  31 ++
 .../unittests/api/deserialize-unittest.cc     | 210 ++++++++++
 16 files changed, 802 insertions(+), 134 deletions(-)

diff --git a/common.gypi b/common.gypi
index a8dbd9ba13e4..5e100167a421 100644
--- a/common.gypi
+++ b/common.gypi
@@ -50,7 +50,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.10',
+    'v8_embedder_string': '-node.11',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index 0a3599ee41c4..2f8ffee6a90f 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -2024,6 +2024,9 @@ void BackgroundCompileTask::Run(
   parser.ParseOnBackground(isolate, &info, script_, start_position_,
                            end_position_, function_literal_id_);
   parser.UpdateStatistics(script_, &use_counts_, &total_preparse_skipped_);
+  if (toplevel_script_compilation) {
+    debug_magic_comment_locations_ = parser.debug_magic_comment_locations();
+  }
 
   TRACE_EVENT(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
               "V8.CompileCodeBackground");
@@ -2767,8 +2770,14 @@ MaybeHandle<SharedFunctionInfo> BackgroundCompileTask::FinalizeScript(
     {
       DisallowGarbageCollection no_gc;
       SetScriptFieldsFromDetails(isolate, *script, script_details, &no_gc);
-      LOG(isolate, ScriptDetails(*script));
     }
+    // After SetScriptFieldsFromDetails, so that a source map URL provided
+    // through the API takes precedence. The locations come from the streamed
+    // source; the embedder is expected to pass the same source here, but an
+    // out-of-bounds location is ignored.
+    Parser::SetDebugMagicCommentFields(isolate, script, source,
+                                       debug_magic_comment_locations_);
+    LOG(isolate, ScriptDetails(*script));
   }
 
   ReportStatistics(isolate);
diff --git a/deps/v8/src/codegen/compiler.h b/deps/v8/src/codegen/compiler.h
index cfa6af01010b..429be4cc70ec 100644
--- a/deps/v8/src/codegen/compiler.h
+++ b/deps/v8/src/codegen/compiler.h
@@ -24,6 +24,7 @@
 #include "src/objects/debug-objects.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/pending-compilation-error-handler.h"
+#include "src/parsing/scanner.h"  // For Scanner::DebugMagicCommentLocations.
 #include "src/snapshot/code-serializer.h"
 #include "src/utils/allocation.h"
 #include "src/zone/zone.h"
@@ -649,6 +650,9 @@ class V8_EXPORT_PRIVATE BackgroundCompileTask {
   DeferredFinalizationJobDataList jobs_to_retry_finalization_on_main_thread_;
   base::SmallVector<v8::Isolate::UseCounterFeature, 8> use_counts_;
   int total_preparse_skipped_ = 0;
+  // The source is not available on the background thread, so the debug magic
+  // comment values are created from these locations when finalizing.
+  Scanner::DebugMagicCommentLocations debug_magic_comment_locations_;
 
   // Single function data for top-level function compilation.
   MaybeIndirectHandle<SharedFunctionInfo> input_shared_info_;
diff --git a/deps/v8/src/parsing/literal-buffer.cc b/deps/v8/src/parsing/literal-buffer.cc
index 32ff27eb10a8..bfc7e762e523 100644
--- a/deps/v8/src/parsing/literal-buffer.cc
+++ b/deps/v8/src/parsing/literal-buffer.cc
@@ -5,29 +5,11 @@
 #include "src/parsing/literal-buffer.h"
 
 #include "src/base/strings.h"
-#include "src/execution/isolate.h"
-#include "src/execution/local-isolate.h"
-#include "src/heap/factory.h"
-#include "src/objects/objects.h"
-#include "src/objects/string.h"
 #include "src/utils/memcopy.h"
 
 namespace v8 {
 namespace internal {
 
-template <typename IsolateT>
-DirectHandle<String> LiteralBuffer::Internalize(IsolateT* isolate) const {
-  if (is_one_byte()) {
-    return isolate->factory()->InternalizeString(one_byte_literal());
-  }
-  return isolate->factory()->InternalizeString(two_byte_literal());
-}
-
-template DirectHandle<String> LiteralBuffer::Internalize(
-    Isolate* isolate) const;
-template DirectHandle<String> LiteralBuffer::Internalize(
-    LocalIsolate* isolate) const;
-
 size_t LiteralBuffer::NewCapacity(size_t min_capacity) {
   return min_capacity < (kMaxGrowth / (kGrowthFactor - 1))
              ? min_capacity * kGrowthFactor
diff --git a/deps/v8/src/parsing/literal-buffer.h b/deps/v8/src/parsing/literal-buffer.h
index b6d7c9e00d09..1f0dff493662 100644
--- a/deps/v8/src/parsing/literal-buffer.h
+++ b/deps/v8/src/parsing/literal-buffer.h
@@ -98,9 +98,6 @@ class LiteralBuffer final {
     is_one_byte_ = true;
   }
 
-  template <typename IsolateT>
-  DirectHandle<String> Internalize(IsolateT* isolate) const;
-
  private:
   static constexpr size_t kInitialCapacity = 256;
   static constexpr size_t kGrowthFactor = 4;
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 388e4f1c96e7..60f140ef5f89 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -20,6 +20,7 @@
 #include "src/common/message-template.h"
 #include "src/common/scoped-modification.h"
 #include "src/compiler-dispatcher/lazy-compile-dispatcher.h"
+#include "src/heap/factory-inl.h"
 #include "src/heap/local-heap-inl.h"
 #include "src/heap/parked-scope.h"
 #include "src/logging/counters.h"
@@ -3572,32 +3573,50 @@ void Parser::InsertSloppyBlockFunctionVarBindings(DeclarationScope* scope) {
 // ----------------------------------------------------------------------------
 // Parser support
 
-template <typename IsolateT>
-void Parser::HandleDebugMagicComments(IsolateT* isolate,
+void Parser::HandleDebugMagicComments(Isolate* isolate,
                                       DirectHandle<Script> script) {
-  DirectHandle<String> source_url = scanner_.SourceUrl(isolate);
-  if (!source_url.is_null()) {
+  // On the main thread, the scanned source is the script source.
+  DirectHandle<String> source(Cast<String>(script->source()), isolate);
+  SetDebugMagicCommentFields(isolate, script, source,
+                             scanner_.debug_magic_comment_locations());
+}
+
+// static
+void Parser::SetDebugMagicCommentFields(
+    Isolate* isolate, DirectHandle<Script> script, DirectHandle<String> source,
+    const Scanner::DebugMagicCommentLocations& locations) {
+  source = String::Flatten(isolate, source);
+  auto is_valid = [&](Scanner::Location location) {
+    return location.IsValid() && location.length() != 0 &&
+           static_cast<uint32_t>(location.end_pos) <= source->length();
+  };
+  if (is_valid(locations.source_url)) {
+    // The source URL is used as the script name (e.g. in stack traces,
+    // profiles and heap snapshots), so it is a sequential copy rather than a
+    // substring of the source.
+    DirectHandle<String> source_url = isolate->factory()->NewCopiedSubstring(
+        source, locations.source_url.beg_pos, locations.source_url.length());
     script->set_source_url(*source_url);
   }
-  DirectHandle<String> source_mapping_url = scanner_.SourceMappingUrl(isolate);
   // The API can provide a source map URL and the API should take precedence.
   // Let's make sure we do not override the API with the magic comment.
-  if (!source_mapping_url.is_null() &&
-      IsUndefined(script->source_mapping_url())) {
+  if (IsUndefined(script->source_mapping_url()) &&
+      is_valid(locations.source_mapping_url)) {
+    // The source map URL can be arbitrarily large (e.g. an inline source map),
+    // so it is a substring of the source rather than a copy.
+    DirectHandle<String> source_mapping_url = isolate->factory()->NewSubString(
+        source, locations.source_mapping_url.beg_pos,
+        locations.source_mapping_url.end_pos);
     script->set_source_mapping_url(*source_mapping_url);
   }
-
-  DirectHandle<String> debug_id = scanner_.DebugId(isolate);
-  if (!debug_id.is_null()) {
+  if (is_valid(locations.debug_id)) {
+    // Debug IDs are short, so they are copied like the source URL.
+    DirectHandle<String> debug_id = isolate->factory()->NewCopiedSubstring(
+        source, locations.debug_id.beg_pos, locations.debug_id.length());
     script->set_debug_id(*debug_id);
   }
 }
 
-template void Parser::HandleDebugMagicComments(Isolate* isolate,
-                                               DirectHandle<Script> script);
-template void Parser::HandleDebugMagicComments(LocalIsolate* isolate,
-                                               DirectHandle<Script> script);
-
 void Parser::UpdateStatistics(Isolate* isolate, DirectHandle<Script> script) {
   CHECK_NOT_NULL(isolate);
 
@@ -3700,9 +3719,6 @@ void Parser::ParseOnBackground(LocalIsolate* isolate, ParseInfo* info,
     MaybeProcessSourceRanges(info, result, stack_limit_);
   });
   // We need to unpark by now though, to be able to internalize.
-  if (flags().is_toplevel()) {
-    HandleDebugMagicComments(isolate, script);
-  }
   if (result == nullptr) return;
   PostProcessParseResult(isolate, info, result);
 }
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index 5226a2ccea66..6a644f85f1cd 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -170,8 +170,19 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       DirectHandle<Script> script,
       base::SmallVector<v8::Isolate::UseCounterFeature, 8>* use_counters,
       int* preparse_skipped);
-  template <typename IsolateT>
-  void HandleDebugMagicComments(IsolateT* isolate, DirectHandle<Script> script);
+  void HandleDebugMagicComments(Isolate* isolate, DirectHandle<Script> script);
+  const Scanner::DebugMagicCommentLocations& debug_magic_comment_locations()
+      const {
+    return scanner_.debug_magic_comment_locations();
+  }
+  // Sets the debug magic comment fields of {script} to the values in {source}
+  // at the given locations: the source map URL is a substring of {source}, the
+  // source URL and debug ID are sequential copies. Locations that are empty,
+  // invalid or out of bounds are ignored.
+  static void SetDebugMagicCommentFields(
+      Isolate* isolate, DirectHandle<Script> script,
+      DirectHandle<String> source,
+      const Scanner::DebugMagicCommentLocations& locations);
 
  private:
   friend class ParserBase<Parser>;
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 374fc4616e14..9355703e367e 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -277,6 +277,27 @@ void ProcessPerFunctionCompileHints(const base::Vector<const uint8_t>& data,
 
 }  // namespace
 
+template <typename CharCallback>
+Scanner::Location Scanner::ScanMagicCommentValue(CharCallback on_char) {
+  DCHECK_EQ(c0_, '=');
+  Advance();
+  while (IsWhiteSpace(c0_)) {
+    Advance();
+  }
+  int value_beg_pos = source_pos();
+  while (c0_ != kEndOfInput && !IsWhiteSpaceOrLineTerminator(c0_)) {
+    on_char(c0_);
+    Advance();
+  }
+  Location value_location(value_beg_pos, source_pos());
+  // Allow whitespace at the end.
+  while (c0_ != kEndOfInput && !unibrow::IsLineTerminator(c0_)) {
+    if (!IsWhiteSpace(c0_)) return Location::invalid();
+    Advance();
+  }
+  return value_location;
+}
+
 void Scanner::TryToParseMagicComment(base::uc32 hash_or_at_sign) {
   // Magic comments are of the form: //[#@]\s<name>=\s*<value>\s*.* and this
   // function will just return if it cannot parse a magic comment.
@@ -293,12 +314,14 @@ void Scanner::TryToParseMagicComment(base::uc32 hash_or_at_sign) {
   }
   if (!name.is_one_byte()) return;
   base::Vector<const uint8_t> name_literal = name.one_byte_literal();
-  LiteralBuffer* value;
-  LiteralBuffer per_function_compile_hints_value;
+  // The debug magic comment values are recorded as source locations, so that
+  // they can be created as substrings of the source instead of being copied.
+  Location* value_location = nullptr;
+  bool is_compile_hints = false;
   if (name_literal == base::StaticOneByteVector("sourceURL")) {
-    value = &source_url_;
+    value_location = &debug_magic_comment_locations_.source_url;
   } else if (name_literal == base::StaticOneByteVector("sourceMappingURL")) {
-    value = &source_mapping_url_;
+    value_location = &debug_magic_comment_locations_.source_mapping_url;
     DCHECK(hash_or_at_sign == '#' || hash_or_at_sign == '@');
     saw_source_mapping_url_magic_comment_at_sign_ = hash_or_at_sign == '@';
   } else if (!saw_non_comment_ &&
@@ -309,45 +332,33 @@ void Scanner::TryToParseMagicComment(base::uc32 hash_or_at_sign) {
   } else if (name_literal ==
                  base::StaticOneByteVector("functionsCalledOnLoad") &&
              hash_or_at_sign == '#') {
-    value = &per_function_compile_hints_value;
+    is_compile_hints = true;
   } else if (name_literal == base::StaticOneByteVector("debugId") &&
              hash_or_at_sign == '#') {
-    value = &debug_id_;
+    value_location = &debug_magic_comment_locations_.debug_id;
   } else {
     return;
   }
   if (c0_ != '=') {
     return;
   }
-  value->Start();
-  Advance();
-  while (IsWhiteSpace(c0_)) {
-    Advance();
-  }
-  while (c0_ != kEndOfInput && !unibrow::IsLineTerminator(c0_)) {
-    if (IsWhiteSpace(c0_)) {
-      break;
-    }
-    value->AddChar(c0_);
-    Advance();
-  }
-  // Allow whitespace at the end.
-  while (c0_ != kEndOfInput && !unibrow::IsLineTerminator(c0_)) {
-    if (!IsWhiteSpace(c0_)) {
-      value->Start();
-      break;
-    }
-    Advance();
-  }
-  if (value == &per_function_compile_hints_value &&
-      per_function_compile_hints_value.is_one_byte()) {
-    base::Vector<const uint8_t> value_literal =
-        per_function_compile_hints_value.one_byte_literal();
-    per_function_compile_hint_positions_.clear();
-    per_function_compile_hint_positions_idx_ = 0;
-    ProcessPerFunctionCompileHints(value_literal, source_pos(),
-                                   per_function_compile_hint_positions_);
+  if (!is_compile_hints) {
+    DCHECK_NOT_NULL(value_location);
+    *value_location = ScanMagicCommentValue([](base::uc32) {});
+    return;
   }
+  LiteralBuffer value;
+  value.Start();
+  Location value_location_in_source =
+      ScanMagicCommentValue([&value](base::uc32 c) { value.AddChar(c); });
+  // A value followed by trailing garbage is treated as empty, which clears
+  // the previously recorded compile hints.
+  if (!value_location_in_source.IsValid()) value.Start();
+  if (!value.is_one_byte()) return;
+  per_function_compile_hint_positions_.clear();
+  per_function_compile_hint_positions_idx_ = 0;
+  ProcessPerFunctionCompileHints(value.one_byte_literal(), source_pos(),
+                                 per_function_compile_hint_positions_);
 }
 
 bool Scanner::HasPerFunctionCompileHint(int position) {
@@ -689,43 +700,6 @@ Token::Value Scanner::ScanTemplateSpan() {
   return result;
 }
 
-template <typename IsolateT>
-DirectHandle<String> Scanner::SourceUrl(IsolateT* isolate) const {
-  DirectHandle<String> tmp;
-  if (source_url_.length() > 0) {
-    tmp = source_url_.Internalize(isolate);
-  }
-  return tmp;
-}
-
-template DirectHandle<String> Scanner::SourceUrl(Isolate* isolate) const;
-template DirectHandle<String> Scanner::SourceUrl(LocalIsolate* isolate) const;
-
-template <typename IsolateT>
-DirectHandle<String> Scanner::SourceMappingUrl(IsolateT* isolate) const {
-  DirectHandle<String> tmp;
-  if (source_mapping_url_.length() > 0) {
-    tmp = source_mapping_url_.Internalize(isolate);
-  }
-  return tmp;
-}
-
-template DirectHandle<String> Scanner::SourceMappingUrl(Isolate* isolate) const;
-template DirectHandle<String> Scanner::SourceMappingUrl(
-    LocalIsolate* isolate) const;
-
-template <typename IsolateT>
-DirectHandle<String> Scanner::DebugId(IsolateT* isolate) const {
-  DirectHandle<String> tmp;
-  if (debug_id_.length() > 0) {
-    tmp = debug_id_.Internalize(isolate);
-  }
-  return tmp;
-}
-
-template DirectHandle<String> Scanner::DebugId(Isolate* isolate) const;
-template DirectHandle<String> Scanner::DebugId(LocalIsolate* isolate) const;
-
 bool Scanner::ScanDigitsWithNumericSeparators(bool (*predicate)(base::uc32 ch),
                                               bool is_check_first_digit) {
   // we must have at least one digit after 'x'/'b'/'o'
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index 087963d1ad35..e700827911c7 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -459,12 +459,18 @@ class V8_EXPORT_PRIVATE Scanner {
     return ScanTemplateSpan();
   }
 
-  template <typename IsolateT>
-  DirectHandle<String> SourceUrl(IsolateT* isolate) const;
-  template <typename IsolateT>
-  DirectHandle<String> SourceMappingUrl(IsolateT* isolate) const;
-  template <typename IsolateT>
-  DirectHandle<String> DebugId(IsolateT* isolate) const;
+  // Source locations of the values of the debug magic comments. A location is
+  // invalid if there was no such comment, or if the last one was malformed; it
+  // is empty if the last one had an empty value. In both cases there is no
+  // value.
+  struct DebugMagicCommentLocations {
+    Location source_url = Location::invalid();
+    Location source_mapping_url = Location::invalid();
+    Location debug_id = Location::invalid();
+  };
+  const DebugMagicCommentLocations& debug_magic_comment_locations() const {
+    return debug_magic_comment_locations_;
+  }
 
   bool SawSourceMappingUrlMagicCommentAtSign() const {
     return saw_source_mapping_url_magic_comment_at_sign_;
@@ -717,6 +723,12 @@ class V8_EXPORT_PRIVATE Scanner {
   Token::Value SkipSingleLineComment();
   Token::Value SkipMagicComment(base::uc32 hash_or_at_sign);
   void TryToParseMagicComment(base::uc32 hash_or_at_sign);
+  // Scans the value of a magic comment, starting at the '=', calling on_char
+  // for each value character. Returns the value's location, or
+  // Location::invalid() if anything but whitespace follows the value on the
+  // line.
+  template <typename CharCallback>
+  Location ScanMagicCommentValue(CharCallback on_char);
   Token::Value SkipMultiLineComment();
   // Scans a possible HTML comment -- begins with '<!'.
   Token::Value ScanHtmlComment();
@@ -802,10 +814,7 @@ class V8_EXPORT_PRIVATE Scanner {
   // Whether this scanner encountered an HTML comment.
   bool found_html_comment_;
 
-  // Values parsed from magic comments.
-  LiteralBuffer source_url_;
-  LiteralBuffer source_mapping_url_;
-  LiteralBuffer debug_id_;
+  DebugMagicCommentLocations debug_magic_comment_locations_;
   bool saw_source_mapping_url_magic_comment_at_sign_ = false;
   bool saw_magic_comment_compile_hints_all_ = false;
   bool saw_non_comment_ = false;
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index 6cfafc4d26b1..9bbf5d3e269f 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -118,6 +118,12 @@ class CodeSerializer : public Serializer {
 
  private:
   void SerializeObjectImpl(Handle<HeapObject> o, SlotType slot_type) override;
+  // Slices usually refer to the script source (e.g. debug magic comment
+  // values), which is an attached object: off-thread deserialization attaches
+  // a placeholder instead of the source.
+  bool SerializeSlicedStringsAsSequentialStrings() const override {
+    return true;
+  }
 
   DISALLOW_GARBAGE_COLLECTION(no_gc_)
   uint32_t source_hash_;
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index 337fc8b243ed..4261fad0758e 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -6,6 +6,7 @@
 
 #include "include/v8-internal.h"
 #include "src/base/logging.h"
+#include "src/base/vector.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/common/globals.h"
 #include "src/handles/global-handles-inl.h"
@@ -705,30 +706,64 @@ void Serializer::ObjectSerializer::SerializeExternalString() {
 void Serializer::ObjectSerializer::SerializeExternalStringAsSequentialString() {
   // Instead of serializing this as an external string, we serialize
   // an imaginary sequential string with the same content.
-  ReadOnlyRoots roots(isolate());
   DCHECK(IsExternalString(*object_));
   DirectHandle<ExternalString> string = Cast<ExternalString>(object_);
+  bool one_byte = IsExternalOneByteString(*object_);
+  const uint8_t* content =
+      one_byte ? reinterpret_cast<const uint8_t*>(
+                     Cast<ExternalOneByteString>(string)->resource()->data())
+               : reinterpret_cast<const uint8_t*>(
+                     Cast<ExternalTwoByteString>(string)->resource()->data());
+  SerializeStringAsSequentialString(one_byte, content);
+}
+
+void Serializer::ObjectSerializer::SerializeSlicedStringAsSequentialString() {
+  // Instead of serializing this as a sliced string, we serialize an imaginary
+  // sequential string with the same content, so that it does not depend on its
+  // parent.
+  DCHECK(IsSlicedString(*object_));
+  DisallowGarbageCollection no_gc;
+  String::FlatContent flat = Cast<String>(*object_)->GetFlatContent(no_gc);
+  DCHECK(flat.IsFlat());
+  if (flat.IsOneByte()) {
+    SerializeStringAsSequentialString(true, flat.ToOneByteVector().begin());
+    return;
+  }
+  base::Vector<const base::uc16> chars = flat.ToUC16Vector();
+  if (String::IsOneByte(chars.begin(), static_cast<uint32_t>(chars.size()))) {
+    // The parent of the slice is two-byte, but its contents are one-byte, so
+    // serialize a one-byte string (which is also what copying them would
+    // create).
+    base::OwnedVector<uint8_t> one_byte =
+        base::OwnedVector<uint8_t>::NewForOverwrite(chars.size());
+    CopyChars(one_byte.begin(), chars.begin(), chars.size());
+    SerializeStringAsSequentialString(true, one_byte.begin());
+    return;
+  }
+  SerializeStringAsSequentialString(
+      false, reinterpret_cast<const uint8_t*>(chars.begin()));
+}
+
+void Serializer::ObjectSerializer::SerializeStringAsSequentialString(
+    bool one_byte, const uint8_t* content) {
+  ReadOnlyRoots roots(isolate());
+  DirectHandle<String> string = Cast<String>(object_);
   uint32_t length = string->length();
   Tagged<Map> map;
   int content_size;
   int allocation_size;
-  const uint8_t* resource;
   // Find the map and size for the imaginary sequential string.
   bool internalized = IsInternalizedString(*object_);
-  if (IsExternalOneByteString(*object_)) {
+  if (one_byte) {
     map = internalized ? roots.internalized_one_byte_string_map()
                        : roots.seq_one_byte_string_map();
     allocation_size = SeqOneByteString::SizeFor(length);
     content_size = length * kCharSize;
-    resource = reinterpret_cast<const uint8_t*>(
-        Cast<ExternalOneByteString>(string)->resource()->data());
   } else {
     map = internalized ? roots.internalized_two_byte_string_map()
                        : roots.seq_two_byte_string_map();
     allocation_size = SeqTwoByteString::SizeFor(length);
     content_size = length * kShortSize;
-    resource = reinterpret_cast<const uint8_t*>(
-        Cast<ExternalTwoByteString>(string)->resource()->data());
   }
 
   SnapshotSpace space = SnapshotSpace::kOld;
@@ -750,7 +785,7 @@ void Serializer::ObjectSerializer::SerializeExternalStringAsSequentialString() {
   }
 
   // Serialize string content.
-  sink_->PutRaw(resource, content_size, "StringContent");
+  sink_->PutRaw(content, content_size, "StringContent");
 
   // Since the allocation size is rounded up to object alignment, there
   // maybe left-over bytes that need to be padded.
@@ -830,6 +865,11 @@ void Serializer::ObjectSerializer::Serialize(SlotType slot_type) {
     SerializeExternalString();
     return;
   }
+  if (InstanceTypeChecker::IsSlicedString(instance_type) &&
+      serializer_->SerializeSlicedStringsAsSequentialStrings()) {
+    SerializeSlicedStringAsSequentialString();
+    return;
+  }
   if (InstanceTypeChecker::IsJSTypedArray(instance_type)) {
     SerializeJSTypedArray();
     return;
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index 85d3556be70e..734e064de1db 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -228,6 +228,11 @@ class Serializer : public SerializerDeserializer {
                                    SlotType slot_type) = 0;
 
   virtual bool MustBeDeferred(Tagged<HeapObject> object);
+  // Whether sliced strings are serialized as sequential strings, so that the
+  // deserialized strings do not depend on their parents.
+  virtual bool SerializeSlicedStringsAsSequentialStrings() const {
+    return false;
+  }
 
   void VisitRootPointers(Root root, const char* description,
                          FullObjectSlot start, FullObjectSlot end) override;
@@ -513,6 +518,8 @@ class Serializer::ObjectSerializer : public ObjectVisitor {
   void SerializeNativeContext();
   void SerializeExternalString();
   void SerializeExternalStringAsSequentialString();
+  void SerializeSlicedStringAsSequentialString();
+  void SerializeStringAsSequentialString(bool one_byte, const uint8_t* content);
 
   Isolate* isolate_;
   Serializer* serializer_;
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index 909f3fcff16a..2771445d2f69 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -595,11 +595,11 @@ static inline v8::Local<v8::Value> CompileRunWithOrigin(
 class StreamerThread : public v8::base::Thread {
  public:
   static void StartThreadForTaskAndJoin(
-      v8::ScriptCompiler::ScriptStreamingTask* task) {
+      v8::ScriptCompiler::ScriptStreamingTask* task,
+      i::Isolate* i_isolate = CcTest::i_isolate()) {
     StreamerThread thread(task);
     CHECK(thread.Start());
     {
-      i::Isolate* i_isolate = CcTest::i_isolate();
       i_isolate->main_thread_local_heap()->ExecuteWhileParked(
           [&thread]() { thread.Join(); });
     }
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index c98c4e2ecb33..65c8c261e7ef 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -30,12 +30,14 @@
 #include <array>
 #include <climits>
 #include <csignal>
+#include <format>
 #include <map>
 #include <memory>
 #include <optional>
 #include <span>
 #include <sstream>
 #include <string>
+#include <string_view>
 
 #include "test/cctest/cctest.h"
 
@@ -24375,6 +24377,60 @@ TEST(ScriptSourceURLAndSourceMappingURL) {
       "function foo() {}\n"
       "//# sourceMappingURL=  data:application/json,{\"version\":3}  \n",
       nullptr, "data:application/json,{\"version\":3}");
+
+  // A value can end at the end of the input.
+  SourceURLHelper(isolate,
+                  "function foo() {}\n"
+                  "//# sourceURL=bar25.js",
+                  "bar25.js", nullptr);
+  SourceURLHelper(isolate,
+                  "function foo() {}\n"
+                  "//# sourceMappingURL=bar26.js",
+                  nullptr, "bar26.js");
+
+  // Other line terminators.
+  SourceURLHelper(isolate,
+                  "function foo() {}\r\n"
+                  "//# sourceURL=bar27.js\r\n"
+                  "//# sourceMappingURL=bar28.js\r\n"
+                  "function baz() {}\r\n",
+                  "bar27.js", "bar28.js");
+  SourceURLHelper(isolate,
+                  "function foo() {}\n"
+                  "//# sourceURL=bar29.js\xE2\x80\xA8"
+                  "function baz() {}\n",
+                  "bar29.js", nullptr);
+
+  // The deprecated //@ form.
+  SourceURLHelper(isolate,
+                  "function foo() {}\n"
+                  "//@ sourceURL=bar30.js\n"
+                  "//@ sourceMappingURL=bar31.js\n",
+                  "bar30.js", "bar31.js");
+
+  // A malformed or empty last comment removes an earlier value.
+  SourceURLHelper(isolate,
+                  "function foo() {}\n"
+                  "//# sourceURL=bar32.js\n"
+                  "//# sourceURL=bar33 .js\n"
+                  "//# sourceMappingURL=bar34.js\n"
+                  "//# sourceMappingURL=\n",
+                  nullptr, nullptr);
+
+  // Non-Latin1 characters in the source and in the value.
+  SourceURLHelper(isolate,
+                  "var s = '\xD7\xA9';\n"
+                  "//# sourceURL=b\xC3\xA4r35\xF0\x9F\x98\x80.js\n",
+                  "b\xC3\xA4r35\xF0\x9F\x98\x80.js", nullptr);
+
+  // Long values.
+  std::string long_url = std::format("https://example.com/{:x>1000}.js", "");
+  std::string long_map_url = long_url + ".map";
+  std::string long_source = std::format(
+      "function foo() {{}}\n//# sourceURL={}\n//# sourceMappingURL={}\n",
+      long_url, long_map_url);
+  SourceURLHelper(isolate, long_source.c_str(), long_url.c_str(),
+                  long_map_url.c_str());
 }
 
 
@@ -26028,6 +26084,322 @@ TEST(StreamingScriptWithSourceMappingURLInTheMiddle) {
                    nullptr, "bar2.js");
 }
 
+namespace {
+
+i::DirectHandle<i::Script> GetScript(v8::Isolate* isolate,
+                                     Local<v8::UnboundScript> script) {
+  return i::direct_handle(
+      i::Cast<i::Script>(v8::Utils::OpenDirectHandle(*script)->script()),
+      reinterpret_cast<i::Isolate*>(isolate));
+}
+
+i::DirectHandle<i::Script> GetScript(v8::Isolate* isolate,
+                                     Local<v8::UnboundModuleScript> script) {
+  return i::direct_handle(
+      i::Cast<i::Script>(v8::Utils::OpenDirectHandle(*script)->script()),
+      reinterpret_cast<i::Isolate*>(isolate));
+}
+
+i::DirectHandle<i::Script> GetScript(v8::Isolate* isolate,
+                                     Local<v8::Function> function) {
+  return i::direct_handle(
+      i::Cast<i::Script>(
+          i::Cast<i::JSFunction>(*v8::Utils::OpenDirectHandle(*function))
+              ->shared()
+              ->script()),
+      reinterpret_cast<i::Isolate*>(isolate));
+}
+
+v8::MaybeLocal<Script> CompileStreamedScript(LocalContext* env,
+                                             const char** chunks,
+                                             Local<v8::String> full_source,
+                                             const v8::ScriptOrigin& origin) {
+  v8::ScriptCompiler::StreamedSource source(
+      std::make_unique<i::TestSourceStream>(chunks),
+      v8::ScriptCompiler::StreamedSource::UTF8);
+  std::unique_ptr<v8::ScriptCompiler::ScriptStreamingTask> task(
+      v8::ScriptCompiler::StartStreaming(env->isolate(), &source));
+  StreamerThread::StartThreadForTaskAndJoin(task.get(), env->i_isolate());
+  return v8::ScriptCompiler::Compile(env->local(), &source, full_source,
+                                     origin);
+}
+
+std::string SourceWithMagicComments(std::string_view body,
+                                    std::string_view value) {
+  return std::format(
+      "{0}\n//# sourceURL={1}\n//# sourceMappingURL={1}\n//# debugId={1}\n",
+      body, value);
+}
+
+// Checks that the debug magic comment values of {script} are {value}: the
+// source map URL as a substring of the script source, the source URL and debug
+// ID as sequential strings.
+void CheckMagicCommentValuesAreSourceSubstrings(
+    i::DirectHandle<i::Script> script, const std::string& value) {
+  i::Tagged<i::Object> source_mapping_url = script->source_mapping_url();
+  CHECK(i::IsSlicedString(source_mapping_url));
+  CHECK_EQ(i::Cast<i::SlicedString>(source_mapping_url)->parent(),
+           script->source());
+  i::Tagged<i::Object> fields[] = {source_mapping_url, script->source_url(),
+                                   script->debug_id()};
+  for (i::Tagged<i::Object> field : fields) {
+    if (field != source_mapping_url) CHECK(i::IsSeqString(field));
+    CHECK(i::Cast<i::String>(field)->IsEqualTo(
+        v8::base::OneByteVector(value.data(), value.size())));
+  }
+}
+
+}  // namespace
+
+TEST(MagicCommentValuesAreSourceSubstrings) {
+  LocalContext env;
+  v8::Isolate* isolate = env.isolate();
+  v8::HandleScope scope(isolate);
+  std::string value = std::format("https://example.com/{:x>100}.js", "");
+
+  {
+    std::string source =
+        SourceWithMagicComments("globalThis.Result = 13;", value);
+    CheckMagicCommentValuesAreSourceSubstrings(
+        GetScript(isolate, v8_compile(source.c_str())->GetUnboundScript()),
+        value);
+  }
+  {
+    std::string source = SourceWithMagicComments("export const x = 13;", value);
+    v8::ScriptOrigin origin(v8_str("module.js"), 0, 0, false, -1,
+                            Local<Value>(), false, false, true);
+    v8::ScriptCompiler::Source script_source(v8_str(source.c_str()), origin);
+    Local<v8::Module> module =
+        v8::ScriptCompiler::CompileModule(isolate, &script_source)
+            .ToLocalChecked();
+    CheckMagicCommentValuesAreSourceSubstrings(
+        GetScript(isolate, module->GetUnboundModuleScript()), value);
+  }
+  {
+    std::string source = SourceWithMagicComments("return 13;", value);
+    v8::ScriptCompiler::Source script_source(v8_str(source.c_str()));
+    Local<v8::Function> function =
+        v8::ScriptCompiler::CompileFunction(env.local(), &script_source)
+            .ToLocalChecked();
+    CheckMagicCommentValuesAreSourceSubstrings(GetScript(isolate, function),
+                                               value);
+  }
+  {
+    // Streaming creates the values from the full source when finalizing.
+    std::string source =
+        SourceWithMagicComments("globalThis.Result = 13;", value);
+    const char* chunks[] = {source.c_str(), nullptr};
+    Local<Script> script =
+        CompileStreamedScript(&env, chunks, v8_str(source.c_str()),
+                              v8::ScriptOrigin(v8_str("streamed.js")))
+            .ToLocalChecked();
+    CheckMagicCommentValuesAreSourceSubstrings(
+        GetScript(isolate, script->GetUnboundScript()), value);
+  }
+  {
+    // Short values are not slices, but still have the right contents.
+    Local<Script> script = v8_compile(
+        "//# sourceURL=a.js\n//# sourceMappingURL=b.js\n//# debugId=c\n");
+    i::DirectHandle<i::Script> i_script =
+        GetScript(isolate, script->GetUnboundScript());
+    CHECK(i::Cast<i::String>(i_script->source_url())->IsOneByteEqualTo("a.js"));
+    CHECK(i::Cast<i::String>(i_script->source_mapping_url())
+              ->IsOneByteEqualTo("b.js"));
+    CHECK(i::Cast<i::String>(i_script->debug_id())->IsOneByteEqualTo("c"));
+  }
+}
+
+// Regression test for https://crbug.com/566467883: the source URL is a
+// sequential string rather than a slice of the source, even if it is long
+// enough to be one, since it is used as the script name (e.g. DevTools reads it
+// from heap snapshots).
+TEST(MagicCommentSourceUrlIsSequential) {
+  LocalContext env;
+  v8::Isolate* isolate = env.isolate();
+  v8::HandleScope scope(isolate);
+  const std::string value = "inside-direct-eval.js";
+  CHECK_GE(value.size(), i::SlicedString::kMinLength);
+  auto check = [&](i::DirectHandle<i::Script> script) {
+    CHECK(i::IsSeqString(script->source_url()));
+    CHECK(!i::IsSlicedString(script->source_url()));
+    CHECK(i::Cast<i::String>(script->source_url())
+              ->IsEqualTo(v8::base::OneByteVector(value.data(), value.size())));
+  };
+
+  {
+    std::string source = "globalThis.Result = 13;\n//# sourceURL=" + value;
+    check(GetScript(isolate, v8_compile(source.c_str())->GetUnboundScript()));
+  }
+  {
+    // Streaming creates the value from the full source when finalizing.
+    std::string source = "globalThis.Result = 13;\n//# sourceURL=" + value;
+    const char* chunks[] = {source.c_str(), nullptr};
+    Local<Script> script =
+        CompileStreamedScript(&env, chunks, v8_str(source.c_str()),
+                              v8::ScriptOrigin(v8_str("streamed.js")))
+            .ToLocalChecked();
+    check(GetScript(isolate, script->GetUnboundScript()));
+  }
+  {
+    // Direct eval.
+    Local<v8::Function> function = Local<v8::Function>::Cast(
+        CompileRun("eval('(function evalFunction() {})\\n"
+                   "//# sourceURL=inside-direct-eval.js');"));
+    check(GetScript(isolate, function));
+  }
+}
+
+TEST(ApiSourceMapURLTakesPrecedenceOverMagicComment) {
+  LocalContext env;
+  v8::Isolate* isolate = env.isolate();
+  v8::HandleScope scope(isolate);
+  std::string value = std::format("https://example.com/{:x>100}.map", "");
+  std::string source =
+      "globalThis.Result = 13;\n//# sourceMappingURL=" + value + "\n";
+  const char* chunks[] = {source.c_str(), nullptr};
+
+  for (bool streaming : {false, true}) {
+    // A non-empty API source map URL takes precedence, an empty one does not.
+    for (const char* api_url : {"api.js.map", ""}) {
+      v8::ScriptOrigin origin(v8_str("origin.js"), 0, 0, false, -1,
+                              v8_str(api_url));
+      Local<Script> script;
+      if (streaming) {
+        script =
+            CompileStreamedScript(&env, chunks, v8_str(source.c_str()), origin)
+                .ToLocalChecked();
+      } else {
+        v8::ScriptCompiler::Source script_source(v8_str(source.c_str()),
+                                                 origin);
+        script = v8::ScriptCompiler::Compile(env.local(), &script_source)
+                     .ToLocalChecked();
+      }
+      v8::String::Utf8Value url(
+          isolate, script->GetUnboundScript()->GetSourceMappingURL());
+      CHECK_EQ(0, strcmp(*api_url != '\0' ? api_url : value.c_str(), *url));
+      // Compile each case from scratch.
+      CcTest::i_isolate()->compilation_cache()->Clear();
+    }
+  }
+}
+
+TEST(StreamingMagicCommentOutsideOfFullSource) {
+  // The embedder passes a full source that does not match the streamed one.
+  // Magic comment locations outside of it must be ignored.
+  LocalContext env;
+  v8::Isolate* isolate = env.isolate();
+  v8::HandleScope scope(isolate);
+  const char* chunks[] = {"globalThis.Result = 13;\n",
+                          "//# sourceURL=outside.js\n",
+                          "//# sourceMappingURL=outside.js.map\n", nullptr};
+  Local<Script> script =
+      CompileStreamedScript(&env, chunks, v8_str("globalThis.Result = 13;\n"),
+                            v8::ScriptOrigin(v8_str("streamed.js")))
+          .ToLocalChecked();
+  i::DirectHandle<i::Script> i_script =
+      GetScript(isolate, script->GetUnboundScript());
+  CHECK(i::IsUndefined(i_script->source_url()));
+  CHECK(i::IsUndefined(i_script->source_mapping_url()));
+}
+
+// Regression test for https://github.com/nodejs/node/issues/64155: a huge
+// magic comment value (e.g. an inline source map) must not be copied onto the
+// heap.
+UNINITIALIZED_TEST(HugeMagicCommentValueDoesNotOOM) {
+  i::v8_flags.stress_concurrent_allocation = false;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  create_params.constraints.set_max_old_generation_size_in_bytes(16 * i::MB);
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  {
+    v8::Isolate::Scope isolate_scope(isolate);
+    v8::HandleScope scope(isolate);
+    LocalContext env(isolate);
+
+    const std::string url_prefix = "data:application/json;base64,";
+    const size_t kPayloadLength = 40 * i::MB;
+    enum class Mode { kScript, kModule, kFunction, kStreaming };
+    for (Mode mode :
+         {Mode::kScript, Mode::kModule, Mode::kFunction, Mode::kStreaming}) {
+      // The source URL and debug ID are sequential copies, so huge ones are
+      // still copied.
+      for (const char* name : {"sourceMappingURL"}) {
+        v8::HandleScope inner_scope(isolate);
+        std::string header = std::format(
+            "{}\n//# {}=",
+            mode == Mode::kFunction ? "return 13;" : "globalThis.Result = 13;",
+            name);
+        size_t value_offset = header.size();
+        size_t value_length = url_prefix.size() + kPayloadLength;
+        size_t length = value_offset + value_length + 1;
+        char* data = i::NewArray<char>(length + 1);
+        memcpy(data, header.data(), header.size());
+        memcpy(data + value_offset, url_prefix.data(), url_prefix.size());
+        memset(data + value_offset + url_prefix.size(), 'A', kPayloadLength);
+        data[length - 1] = '\n';
+        data[length] = '\0';
+
+        // The source is external, so it does not count against the heap
+        // limit, but a copy of the magic comment value would.
+        Local<v8::String> source = v8::String::NewExternalOneByte(
+                                       isolate, new TestOneByteResource(data))
+                                       .ToLocalChecked();
+        i::DirectHandle<i::Script> script;
+        switch (mode) {
+          case Mode::kScript: {
+            v8::ScriptCompiler::Source script_source(source);
+            script =
+                GetScript(isolate, v8::ScriptCompiler::CompileUnboundScript(
+                                       isolate, &script_source)
+                                       .ToLocalChecked());
+            break;
+          }
+          case Mode::kModule: {
+            v8::ScriptOrigin origin(
+                v8::String::NewFromUtf8Literal(isolate, "module.js"), 0, 0,
+                false, -1, Local<Value>(), false, false, true);
+            v8::ScriptCompiler::Source script_source(source, origin);
+            script = GetScript(isolate, v8::ScriptCompiler::CompileModule(
+                                            isolate, &script_source)
+                                            .ToLocalChecked()
+                                            ->GetUnboundModuleScript());
+            break;
+          }
+          case Mode::kFunction: {
+            v8::ScriptCompiler::Source script_source(source);
+            script = GetScript(isolate, v8::ScriptCompiler::CompileFunction(
+                                            env.local(), &script_source)
+                                            .ToLocalChecked());
+            break;
+          }
+          case Mode::kStreaming: {
+            const char* chunks[] = {data, nullptr};
+            script = GetScript(
+                isolate, CompileStreamedScript(
+                             &env, chunks, source,
+                             v8::ScriptOrigin(v8::String::NewFromUtf8Literal(
+                                 isolate, "streamed.js")))
+                             .ToLocalChecked()
+                             ->GetUnboundScript());
+            break;
+          }
+        }
+        i::Tagged<i::Object> value = script->source_mapping_url();
+        i::DirectHandle<i::String> value_string(
+            i::Cast<i::String>(value), reinterpret_cast<i::Isolate*>(isolate));
+
+        // Force a full GC while the value is alive: a heap copy of the value
+        // would exceed the heap limit here even if its allocation succeeded.
+        isolate->LowMemoryNotification();
+
+        CHECK(value_string->IsEqualTo(
+            v8::base::OneByteVector(data + value_offset, value_length)));
+      }
+    }
+  }
+  isolate->Dispose();
+}
+
 void GetCurrentHostDefinedOptionsTest(
     const v8::FunctionCallbackInfo<Value>& info) {
   v8::Local<v8::Data> host_defined_options =
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index 81895814bfb2..daf45db8d96f 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -3662,6 +3662,37 @@ TEST(HeapSnapshotScriptContext) {
   CHECK(found_foo);
 }
 
+TEST(HeapSnapshotScriptSourceUrl) {
+  // The source_url node of a script is named by the source URL, even if it is
+  // long enough to be a sliced string. DevTools relies on this.
+  LocalContext env;
+  v8::HandleScope scope(env.isolate());
+  v8::HeapProfiler* heap_profiler = env.isolate()->GetHeapProfiler();
+
+  CompileRun(
+      "eval('globalThis.f = function f() {};\\n"
+      "//# sourceURL=inside-direct-eval.js');");
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphNode* f =
+      GetProperty(env.isolate(), global, v8::HeapGraphEdge::kProperty, "f");
+  CHECK(f);
+  const v8::HeapGraphNode* shared =
+      GetProperty(env.isolate(), f, v8::HeapGraphEdge::kInternal, "shared");
+  CHECK(shared);
+  const v8::HeapGraphNode* script = GetProperty(
+      env.isolate(), shared, v8::HeapGraphEdge::kInternal, "script");
+  CHECK(script);
+  const v8::HeapGraphNode* source_url = GetProperty(
+      env.isolate(), script, v8::HeapGraphEdge::kInternal, "source_url");
+  CHECK(source_url);
+  CHECK_EQ(v8::HeapGraphNode::kString, source_url->GetType());
+  v8::String::Utf8Value name(env.isolate(), source_url->GetName());
+  CHECK_EQ(0, strcmp("inside-direct-eval.js", *name));
+  heap_profiler->DeleteAllHeapSnapshots();
+}
+
 class EmbedderNode : public v8::EmbedderGraph::Node {
  public:
   EmbedderNode(const char* name, size_t size,
diff --git a/deps/v8/test/unittests/api/deserialize-unittest.cc b/deps/v8/test/unittests/api/deserialize-unittest.cc
index fb9fb9983b7d..4eee48ebb3b3 100644
--- a/deps/v8/test/unittests/api/deserialize-unittest.cc
+++ b/deps/v8/test/unittests/api/deserialize-unittest.cc
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <format>
+#include <string_view>
+
 #include "include/v8-context.h"
 #include "include/v8-function.h"
 #include "include/v8-isolate.h"
@@ -9,8 +12,11 @@
 #include "include/v8-platform.h"
 #include "include/v8-primitive.h"
 #include "include/v8-script.h"
+#include "src/api/api-inl.h"
 #include "src/codegen/compilation-cache.h"
 #include "src/common/synchronization-point-support.h"
+#include "src/objects/script-inl.h"
+#include "src/objects/string-inl.h"
 #include "test/unittests/heap/heap-utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -198,6 +204,210 @@ TEST_F(DeserializeTest, OffThreadDeserialize) {
   }
 }
 
+namespace {
+
+std::string LongMagicCommentValue() {
+  return std::format("data:application/json;base64,{:A>2000}", "");
+}
+
+std::string SourceWithLongMagicComments(
+    std::string_view body = "function foo() { return 42; }") {
+  return std::format(
+      "{0}\n//# sourceURL={1}\n//# sourceMappingURL={1}\n//# debugId={1}\n",
+      body, LongMagicCommentValue());
+}
+
+// Compiled scripts have the source map URL magic comment value as a slice of
+// the source (the source URL and debug ID are sequential copies). The code
+// cache contains it as a sequential string, since the slice could not be
+// deserialized off-thread, where the source is not available.
+void CheckLongMagicCommentValues(Isolate* isolate, Local<Script> script,
+                                 bool expect_slices) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  i::DirectHandle<i::Script> i_script(
+      i::Cast<i::Script>(
+          Utils::OpenDirectHandle(*script->GetUnboundScript())->script()),
+      i_isolate);
+  std::string value = LongMagicCommentValue();
+  // The source URL and debug ID are always sequential strings.
+  i::Tagged<i::Object> copied_fields[] = {i_script->source_url(),
+                                          i_script->debug_id()};
+  for (i::Tagged<i::Object> field : copied_fields) {
+    CHECK(i::IsSeqString(field));
+    CHECK(i::Cast<i::String>(field)->IsEqualTo(
+        base::OneByteVector(value.data(), value.size())));
+  }
+  i::Tagged<i::Object> source_mapping_url = i_script->source_mapping_url();
+  CHECK_EQ(expect_slices, i::IsSlicedString(source_mapping_url));
+  if (expect_slices) {
+    CHECK_EQ(i::Cast<i::SlicedString>(source_mapping_url)->parent(),
+             i_script->source());
+  }
+  CHECK(i::Cast<i::String>(source_mapping_url)
+            ->IsEqualTo(base::OneByteVector(value.data(), value.size())));
+}
+
+}  // namespace
+
+TEST_F(DeserializeTest, DeserializeLongMagicComments) {
+  std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;
+  std::string source_text = SourceWithLongMagicComments();
+
+  {
+    IsolateAndContextScope scope(this);
+    Local<Script> script =
+        Script::Compile(context(), NewString(source_text.c_str()))
+            .ToLocalChecked();
+    CheckLongMagicCommentValues(isolate(), script, true);
+    cached_data.reset(
+        ScriptCompiler::CreateCodeCache(script->GetUnboundScript()));
+  }
+
+  {
+    IsolateAndContextScope scope(this);
+    ScriptCompiler::Source source(NewString(source_text.c_str()),
+                                  cached_data.release());
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    CHECK(!source.GetCachedData()->rejected);
+    CheckLongMagicCommentValues(isolate(), script, false);
+    CHECK(!script->Run(context()).IsEmpty());
+    CHECK_EQ(RunGlobalFunc("foo"), Integer::New(isolate(), 42));
+  }
+}
+
+TEST_F(DeserializeTest, OffThreadDeserializeLongMagicComments) {
+  std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;
+  std::string source_text = SourceWithLongMagicComments();
+
+  {
+    IsolateAndContextScope scope(this);
+    Local<Script> script =
+        Script::Compile(context(), NewString(source_text.c_str()))
+            .ToLocalChecked();
+    CheckLongMagicCommentValues(isolate(), script, true);
+    cached_data.reset(
+        ScriptCompiler::CreateCodeCache(script->GetUnboundScript()));
+  }
+
+  {
+    IsolateAndContextScope scope(this);
+    DeserializeThread deserialize_thread(
+        ScriptCompiler::StartConsumingCodeCache(
+            isolate(), std::make_unique<ScriptCompiler::CachedData>(
+                           cached_data->data, cached_data->length,
+                           ScriptCompiler::CachedData::BufferNotOwned)));
+    CHECK(deserialize_thread.Start());
+    deserialize_thread.Join();
+
+    ScriptCompiler::Source source(NewString(source_text.c_str()),
+                                  cached_data.release(),
+                                  deserialize_thread.TakeTask().release());
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    CHECK(!source.GetCachedData()->rejected);
+    CheckLongMagicCommentValues(isolate(), script, false);
+    CHECK(!script->Run(context()).IsEmpty());
+    CHECK_EQ(RunGlobalFunc("foo"), Integer::New(isolate(), 42));
+  }
+}
+
+TEST_F(DeserializeTest, DeserializeLongMagicCommentsFromTwoByteSource) {
+  // The source is two-byte, but the magic comment values are one-byte. The
+  // values are two-byte slices of the source, but should be cached (and
+  // deserialized) as one-byte strings.
+  std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;
+  std::string source_text = SourceWithLongMagicComments(
+      "var s = '\xD7\x90';\nfunction foo() { return 42; }");
+
+  {
+    IsolateAndContextScope scope(this);
+    Local<Script> script =
+        Script::Compile(context(), NewString(source_text.c_str()))
+            .ToLocalChecked();
+    CheckLongMagicCommentValues(isolate(), script, true);
+    i::DirectHandle<i::Script> i_script(
+        i::Cast<i::Script>(
+            Utils::OpenDirectHandle(*script->GetUnboundScript())->script()),
+        reinterpret_cast<i::Isolate*>(isolate()));
+    CHECK(i::Cast<i::String>(i_script->source())->IsTwoByteRepresentation());
+    cached_data.reset(
+        ScriptCompiler::CreateCodeCache(script->GetUnboundScript()));
+  }
+
+  for (bool off_thread : {false, true}) {
+    IsolateAndContextScope scope(this);
+    auto data = std::make_unique<ScriptCompiler::CachedData>(
+        cached_data->data, cached_data->length,
+        ScriptCompiler::CachedData::BufferNotOwned);
+    std::unique_ptr<ScriptCompiler::ConsumeCodeCacheTask> task;
+    if (off_thread) {
+      DeserializeThread deserialize_thread(
+          ScriptCompiler::StartConsumingCodeCache(
+              isolate(), std::make_unique<ScriptCompiler::CachedData>(
+                             cached_data->data, cached_data->length,
+                             ScriptCompiler::CachedData::BufferNotOwned)));
+      CHECK(deserialize_thread.Start());
+      deserialize_thread.Join();
+      task = deserialize_thread.TakeTask();
+    }
+    ScriptCompiler::Source source(NewString(source_text.c_str()),
+                                  data.release(), task.release());
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    CHECK(!source.GetCachedData()->rejected);
+    CheckLongMagicCommentValues(isolate(), script, false);
+    i::DirectHandle<i::Script> i_script(
+        i::Cast<i::Script>(
+            Utils::OpenDirectHandle(*script->GetUnboundScript())->script()),
+        reinterpret_cast<i::Isolate*>(isolate()));
+    i::Tagged<i::Object> fields[] = {i_script->source_url(),
+                                     i_script->source_mapping_url(),
+                                     i_script->debug_id()};
+    for (i::Tagged<i::Object> field : fields) {
+      CHECK(i::IsSeqOneByteString(field));
+    }
+  }
+}
+
+TEST_F(DeserializeTest, DeserializeKeepsApiSourceMapURL) {
+  std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;
+  std::string source_text = SourceWithLongMagicComments();
+  auto compile = [&](ScriptCompiler::CachedData* data) {
+    ScriptOrigin origin(NewString("origin.js"), 0, 0, false, -1,
+                        NewString("api.js.map"));
+    ScriptCompiler::Source source(NewString(source_text.c_str()), origin, data);
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                data ? ScriptCompiler::kConsumeCodeCache
+                                     : ScriptCompiler::kNoCompileOptions)
+            .ToLocalChecked();
+    CHECK(!data || !source.GetCachedData()->rejected);
+    String::Utf8Value url(isolate(),
+                          script->GetUnboundScript()->GetSourceMappingURL());
+    CHECK_EQ(0, strcmp("api.js.map", *url));
+    return script;
+  };
+
+  {
+    IsolateAndContextScope scope(this);
+    Local<Script> script = compile(nullptr);
+    cached_data.reset(
+        ScriptCompiler::CreateCodeCache(script->GetUnboundScript()));
+  }
+
+  {
+    IsolateAndContextScope scope(this);
+    compile(cached_data.release());
+  }
+}
+
 // Check that off-thread deserialization works.
 TEST_F(DeserializeTest, OffThreadDeserializeRejectsDifferentSource) {
   std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;

From e846ccb7e766bce2688758be3c3c20cb2534d59e Mon Sep 17 00:00:00 2001
From: eliau2005 <eliau.elkouby@gmail.com>
Date: Tue, 13 Oct 2026 12:24:14 +0300
Subject: [PATCH 2/2] test: add worker large inline source map test

Signed-off-by: eliau2005 <eliau.elkouby@gmail.com>
---
 .../test-worker-large-inline-source-map.js    | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 test/parallel/test-worker-large-inline-source-map.js

diff --git a/test/parallel/test-worker-large-inline-source-map.js b/test/parallel/test-worker-large-inline-source-map.js
new file mode 100644
index 000000000000..253ecad959f6
--- /dev/null
+++ b/test/parallel/test-worker-large-inline-source-map.js
@@ -0,0 +1,24 @@
+'use strict';
+// Regression test for https://github.com/nodejs/node/issues/64155.
+// V8 used to copy the value of a //# sourceMappingURL= magic comment onto
+// the heap while parsing, so a large inline source map aborted the process
+// when loaded in a worker with a small heap, although the (external) source
+// itself fits. The value is now a substring of the source.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const { Worker } = require('worker_threads');
+
+tmpdir.refresh();
+const workerPath = tmpdir.resolve('worker.cjs');
+fs.writeFileSync(workerPath,
+                 "require('worker_threads').parentPort.postMessage('loaded');\n" +
+                 '//# sourceMappingURL=data:application/json;base64,' +
+                 'A'.repeat(32 * 1024 * 1024) + '\n');
+
+const worker = new Worker(workerPath, {
+  resourceLimits: { maxOldGenerationSizeMb: 16 },
+});
+worker.on('message', common.mustCall((msg) => assert.strictEqual(msg, 'loaded')));
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));