From c46cc7a032bd26cf6e7c2d8db8e6f849b83d9b57 Mon Sep 17 00:00:00 2001
From: pthier <[email protected]>
Date: Wed, 12 Aug 2026 10:11:16 +0200
Subject: [PATCH] Fix String.toWellFormed

Check that the destination is a sequential 2-byte string. Since the
destination is freshly allocated, this will always hold.
This prevents racy memory corruption between allocation and writing the
data.

Fixed: 541604100
Change-Id: I4201575476a40e690aee86d1aff0ca7a7f3ef9cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8234944
Reviewed-by: Olivier Flückiger <[email protected]>
Commit-Queue: Patrick Thier <[email protected]>
Auto-Submit: Patrick Thier <[email protected]>
Cr-Commit-Position: refs/heads/main@{#109196}
---

diff --git a/src/builtins/builtins-string-gen.cc b/src/builtins/builtins-string-gen.cc
index d763ebb..06c2de1 100644
--- a/src/builtins/builtins-string-gen.cc
+++ b/src/builtins/builtins-string-gen.cc
@@ -1859,13 +1859,16 @@
             if_indirect);
 
   TNode<RawPtrT> source_data = DirectStringData(source, source_instance_type);
-  // The destination string is a freshly allocated SeqString, and so is always
-  // direct.
-  TNode<Uint16T> dest_instance_type = LoadInstanceType(dest);
-  CSA_DCHECK(this, Word32Equal(Word32And(dest_instance_type,
-                                         Int32Constant(kStringEncodingMask)),
-                               Int32Constant(kTwoByteStringTag)));
-  TNode<RawPtrT> dest_data = DirectStringData(dest, dest_instance_type);
+  // The destination string is a freshly allocated TwoByteSeqString, and so is
+  // always direct.
+  CSA_DCHECK(this,
+             Word32Equal(
+                 Word32And(LoadInstanceType(dest),
+                           Int32Constant(kIsNotStringMask |
+                                         kStringRepresentationAndEncodingMask)),
+                 Int32Constant(kSeqTwoByteStringTag)));
+  TNode<RawPtrT> dest_data =
+      DirectStringData(dest, Int32Constant(SEQ_TWO_BYTE_STRING_TYPE));
   TNode<IntPtrT> length = LoadStringLengthAsWord(source);
   CSA_DCHECK(this, IntPtrEqual(length, LoadStringLengthAsWord(dest)));