diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index d47b8f7f5c8b..0776c052108f 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 15
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 75
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 19
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index fbcf0d8ba77a..0a3599ee41c4 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -2852,8 +2852,8 @@ void BackgroundDeserializeTask::Run() {
   LocalHandleScope handle_scope(&isolate);
 
   DirectHandle<SharedFunctionInfo> inner_result;
-  off_thread_data_ =
-      CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_);
+  CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_,
+                                            &off_thread_data_);
   if (v8_flags.enable_slow_asserts && off_thread_data_.HasResult()) {
 #ifdef ENABLE_SLOW_DCHECKS
     MergeAssumptionChecker checker(&isolate, false);
@@ -2866,6 +2866,11 @@ void BackgroundDeserializeTask::SourceTextAvailable(
     Isolate* isolate, Handle<String> source_text,
     const ScriptDetails& script_details) {
   DCHECK_EQ(isolate, isolate_for_local_isolate_);
+  if (!CodeSerializer::NotifySourceTextAvailable(isolate, &off_thread_data_,
+                                                 &cached_data_, source_text,
+                                                 script_details)) {
+    return;
+  }
   LanguageMode language_mode = construct_language_mode(v8_flags.use_strict);
   background_merge_task_.SetUpOnMainThread(isolate, source_text, script_details,
                                            language_mode);
diff --git a/deps/v8/src/codegen/compiler.h b/deps/v8/src/codegen/compiler.h
index 7f8c3152e8ac..cfa6af01010b 100644
--- a/deps/v8/src/codegen/compiler.h
+++ b/deps/v8/src/codegen/compiler.h
@@ -719,7 +719,7 @@ class V8_EXPORT_PRIVATE BackgroundDeserializeTask {
  private:
   Isolate* isolate_for_local_isolate_;
   AlignedCachedData cached_data_;
-  CodeSerializer::OffThreadDeserializeData off_thread_data_;
+  OffThreadDeserializeData off_thread_data_;
   BackgroundMergeTask background_merge_task_;
   TimedHistogram* timer_;
   int64_t background_time_in_microseconds_ = 0;
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 7ae7d8f99d02..681dac659f1f 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -1760,17 +1760,6 @@ KeyedAccessLoadMode GetUpdatedLoadModeForMap(Isolate* isolate,
 Handle<Object> KeyedLoadIC::LoadElementHandler(
     DirectHandle<Map> receiver_map, KeyedAccessLoadMode new_load_mode,
     MaybeDirectHandle<Map> maybe_transition_target) {
-  // Has a getter interceptor, or is any has and has a query interceptor.
-  if (receiver_map->has_indexed_interceptor() &&
-      (receiver_map->GetIndexedInterceptor()->has_getter() ||
-       (IsAnyHas() && receiver_map->GetIndexedInterceptor()->has_query())) &&
-      !receiver_map->GetIndexedInterceptor()->non_masking()) {
-    // TODO(jgruber): Update counter name.
-    TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_LoadIndexedInterceptorStub);
-    return IsAnyHas() ? BUILTIN_CODE(isolate(), HasIndexedInterceptorIC)
-                      : BUILTIN_CODE(isolate(), LoadIndexedInterceptorIC);
-  }
-
   InstanceType instance_type = receiver_map->instance_type();
   if (instance_type < FIRST_NONSTRING_TYPE) {
     TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_LoadIndexedStringDH);
@@ -1784,6 +1773,23 @@ Handle<Object> KeyedLoadIC::LoadElementHandler(
   if (instance_type == JS_PROXY_TYPE) {
     return LoadHandler::LoadProxy(isolate());
   }
+  if (receiver_map->is_access_check_needed()) {
+    TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_SlowStub);
+    return LoadHandler::LoadSlow(isolate());
+  }
+
+  // Has a getter interceptor, or is any has and has a query interceptor.
+  if (receiver_map->has_indexed_interceptor() &&
+      (receiver_map->GetIndexedInterceptor()->has_getter() ||
+       (IsAnyHas() && receiver_map->GetIndexedInterceptor()->has_query())) &&
+      !receiver_map->GetIndexedInterceptor()->non_masking()) {
+    DCHECK(!receiver_map->is_access_check_needed());
+    // TODO(jgruber): Update counter name.
+    TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_LoadIndexedInterceptorStub);
+    return IsAnyHas() ? BUILTIN_CODE(isolate(), HasIndexedInterceptorIC)
+                      : BUILTIN_CODE(isolate(), LoadIndexedInterceptorIC);
+  }
+
 #if V8_ENABLE_WEBASSEMBLY
   if (InstanceTypeChecker::IsWasmObject(instance_type)) {
     // TODO(jgruber): Update counter name.
@@ -2870,7 +2876,8 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
 Handle<Object> KeyedStoreIC::StoreElementHandler(
     DirectHandle<Map> receiver_map, KeyedAccessStoreMode store_mode,
     MaybeDirectHandle<UnionOf<Smi, Cell>> prev_validity_cell) {
-  if (!IsJSObjectMap(*receiver_map)) {
+  if (!IsJSObjectMap(*receiver_map) || receiver_map->is_access_check_needed() ||
+      receiver_map->IsMapInArrayPrototypeChain(isolate())) {
     // DefineKeyedOwnIC, which is used to define computed fields in instances,
     // should handled by the slow stub below instead of the proxy stub.
     if (IsJSProxyMap(*receiver_map) && !IsDefineKeyedOwnIC()) {
diff --git a/deps/v8/src/maglev/maglev-graph-builder.cc b/deps/v8/src/maglev/maglev-graph-builder.cc
index b0bca8d41281..ca199bab0fab 100644
--- a/deps/v8/src/maglev/maglev-graph-builder.cc
+++ b/deps/v8/src/maglev/maglev-graph-builder.cc
@@ -9110,16 +9110,21 @@ MaglevGraphBuilder::BuildJSArrayBuiltinMapSwitchOnElementsKind(
         sub_graph.GotoOrTrim(&*object_case);
         sub_graph.Bind(&*object_case);
       }
-      any_successful |= (!build_kind_specific(kind).IsDoneWithAbort());
+      ReduceResult result = build_kind_specific(kind);
       if (IsSmiElementsKind(kind) && make_smi_fallthrough_to_object) {
         // After building the SMI specific parts (see build_kind_specific call
         // above), jump to the beginning of the case for the object elements
         // kind.
         DCHECK(object_case.has_value());
         sub_graph.GotoOrTrim(&*object_case);
+
+        // Whether the Smi case is successful depends on whether the object case
+        // is successful, so don't update any_successful here.
       } else {
         DCHECK(do_return.has_value());
         sub_graph.GotoOrTrim(&*do_return);
+
+        any_successful |= !result.IsDoneWithAbort();
       }
       sub_graph.Bind(&check_next_map);
     } else {
@@ -16971,11 +16976,11 @@ void MaglevGraphBuilder::ProcessMergePointPredecessors(
   ResetBuilderCachedState();
 
   if (merge_state.is_loop()) {
-    DCHECK_EQ(merge_state.predecessors_so_far(),
-              merge_state.predecessor_count() - 1);
+    CHECK_EQ(merge_state.predecessors_so_far(),
+             merge_state.predecessor_count() - 1);
   } else {
-    DCHECK_EQ(merge_state.predecessors_so_far(),
-              merge_state.predecessor_count());
+    CHECK_EQ(merge_state.predecessors_so_far(),
+             merge_state.predecessor_count());
   }
 
   if (merge_state.predecessor_count() == 1) {
diff --git a/deps/v8/src/maglev/maglev-known-node-aspects.cc b/deps/v8/src/maglev/maglev-known-node-aspects.cc
index f4abfca24955..63895d1f5f05 100644
--- a/deps/v8/src/maglev/maglev-known-node-aspects.cc
+++ b/deps/v8/src/maglev/maglev-known-node-aspects.cc
@@ -652,22 +652,22 @@ void KnownNodeAspects::ClearUnstableNodeAspectsForStoreMap(
     StoreMap* node, bool is_tracing_enabled) {
   if (!node->is_transitioning()) return;
 
-  if (NodeInfo* node_info = TryGetInfoFor(node->ValueInput().node())) {
-    if (node_info->possible_maps_are_known() && !node_info->maps_are_stale() &&
-        node_info->possible_maps().size() == 1) {
-      compiler::MapRef old_map = node_info->possible_maps().at(0);
-      auto MaybeAliases = [&](compiler::MapRef map) -> bool {
-        return map.equals(old_map);
-      };
-      // Mark aliasing maps as stale.
-      if (MarkMapsStaleIfAny(MaybeAliases)) {
-        if (V8_UNLIKELY(v8_flags.trace_maglev_kna && is_tracing_enabled)) {
-          std::cout << kRed << "[KNA] StoreMap: Invalidate alias "
-                    << Brief(*old_map.object()) << kReset << std::endl;
-        }
-      }
-      return;
-    }
+  if (MarkSingleMapAsStale(node->ValueInput().node(), is_tracing_enabled)) {
+    return;
+  }
+
+  // TODO(olivf): Only invalidate nodes with the same type.
+  OnSideEffect();
+  if (V8_UNLIKELY(v8_flags.trace_maglev_kna && is_tracing_enabled)) {
+    std::cout << kRed << "[KNA] StoreMap: Invalidate all unstable maps"
+              << kReset << std::endl;
+  }
+}
+
+void KnownNodeAspects::ClearUnstableNodeAspectsForMigration(
+    Node* node, bool is_tracing_enabled) {
+  if (MarkSingleMapAsStale(node->input_node(0), is_tracing_enabled)) {
+    return;
   }
 
   // TODO(olivf): Only invalidate nodes with the same type.
@@ -1009,6 +1009,28 @@ KnownNodeAspects::ContextStoreResult KnownNodeAspects::RecordContextSlotStore(
   return {ContextStoreResult::kSetNewValue, std::move(aliased_slots)};
 }
 
+bool KnownNodeAspects::MarkSingleMapAsStale(ValueNode* node,
+                                            bool is_tracing_enabled) {
+  if (NodeInfo* node_info = TryGetInfoFor(node)) {
+    if (node_info->possible_maps_are_known() && !node_info->maps_are_stale() &&
+        node_info->possible_maps().size() == 1) {
+      compiler::MapRef old_map = node_info->possible_maps().at(0);
+      auto MaybeAliases = [&](compiler::MapRef map) -> bool {
+        return map.equals(old_map);
+      };
+      // Mark aliasing maps as stale.
+      if (MarkMapsStaleIfAny(MaybeAliases)) {
+        if (V8_UNLIKELY(v8_flags.trace_maglev_kna && is_tracing_enabled)) {
+          std::cout << kRed << "[KNA]: MarkSingleMapAsStale: Invalidate alias "
+                    << Brief(*old_map.object()) << kReset << std::endl;
+        }
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 #ifdef DEBUG
 bool IsStringRootIndex(RootIndex index) {
   if (index > RootIndex::kLastReadOnlyRoot) return false;
diff --git a/deps/v8/src/maglev/maglev-known-node-aspects.h b/deps/v8/src/maglev/maglev-known-node-aspects.h
index b7f039113668..dd1ce8cc3858 100644
--- a/deps/v8/src/maglev/maglev-known-node-aspects.h
+++ b/deps/v8/src/maglev/maglev-known-node-aspects.h
@@ -407,6 +407,8 @@ class KnownNodeAspects {
 
   void ClearUnstableNodeAspectsForStoreMap(StoreMap* node,
                                            bool is_tracing_enabled);
+  void ClearUnstableNodeAspectsForMigration(Node* node,
+                                            bool is_tracing_enabled);
   void ClearUnstableNodeAspectsForElementsTransition(
       const ZoneVector<compiler::MapRef>& transition_sources,
       bool is_tracing_enabled);
@@ -824,8 +826,7 @@ class KnownNodeAspects {
                          std::is_same_v<NodeT,
                                         CheckMapsWithMigrationAndDeopt> ||
                          std::is_same_v<NodeT, MigrateMapIfNeeded>) {
-      // These instructions only migrate representations of values, not the
-      // values themselves, so cached values are still valid.
+      ClearUnstableNodeAspectsForMigration(node, is_tracing_enabled);
     } else if constexpr (std::is_same_v<NodeT, StoreMap>) {
       ClearUnstableNodeAspectsForStoreMap(node, is_tracing_enabled);
     } else if constexpr (std::is_same_v<NodeT, TransitionElementsKind> ||
@@ -910,6 +911,8 @@ class KnownNodeAspects {
   SmallZoneVector<LoadedContextSlotsKey, 8> ClearAliasedContextSlotsFor(
       Graph* graph, ValueNode* context, int offset, ValueNode* value);
 
+  bool MarkSingleMapAsStale(ValueNode* node, bool is_tracing_enabled);
+
   static constexpr uint32_t kEffectEpochForPureInstructions =
       std::numeric_limits<uint32_t>::max();
   static constexpr uint32_t kEffectEpochOverflow =
diff --git a/deps/v8/src/maglev/maglev-phi-representation-selector.cc b/deps/v8/src/maglev/maglev-phi-representation-selector.cc
index eff255ed43c5..5b44744d9e95 100644
--- a/deps/v8/src/maglev/maglev-phi-representation-selector.cc
+++ b/deps/v8/src/maglev/maglev-phi-representation-selector.cc
@@ -1074,7 +1074,7 @@ ValueNode* MaglevPhiRepresentationSelector::GetReplacementForPhiInputConversion(
 }
 
 ProcessResult MaglevPhiRepresentationSelector::UpdateUntaggingOfPhi(
-    Phi* phi, ValueNode* old_untagging) {
+    Phi* phi, ValueNode* old_untagging, const ProcessingState* state) {
   DCHECK_EQ(old_untagging->input_count(), 1);
   DCHECK(old_untagging->input(0).node()->Is<Phi>());
 
@@ -1192,24 +1192,27 @@ ProcessResult MaglevPhiRepresentationSelector::UpdateUntaggingOfPhi(
   if (old_untagging->Is<TruncateUnsafeNumberOrOddballToInt32>()) {
     conversion_is_truncating_float64 = true;
   } else if (old_untagging->Is<TruncateCheckedNumberOrOddballToInt32>()) {
-    if (from_repr == ValueRepresentation::kFloat64) {
-      // If {from_repr} is Float64, then the "CheckedNumber" part is
-      // guaranteed to pass and this operation just truncates its value to
-      // Int32.
-      conversion_is_truncating_float64 = true;
-    } else {
-      DCHECK_EQ(from_repr, ValueRepresentation::kHoleyFloat64);
+    if (from_repr == ValueRepresentation::kHoleyFloat64) {
       const auto* truncate =
           old_untagging->Cast<TruncateCheckedNumberOrOddballToInt32>();
       // A HoleyFloat64 hole really means Undefined rather than the_hole:
       // whenever it gets rematerialized, it will always be rematerialized as
-      // Undefined. So, we can use a truncating conversion as long as the
-      // original assumed input type was allowing truncating Undefined.
-      // Assumptions without Undefined need to deopt for Hole/Undefined
-      // ==> not truncating.
-      conversion_is_truncating_float64 = !NodeTypeIs(
-          truncate->assumed_input_type(), NodeType::kNumberOrBoolean);
+      // Undefined. Assumptions without Undefined need to deopt on
+      // Hole/Undefined before truncating the Float64 value to Int32.
+      if (!NodeTypeCanBe(truncate->assumed_input_type(),
+                         NodeType::kUndefined)) {
+        eager_deopt_frame_ = &old_untagging->eager_deopt_info()->top_frame();
+        AddNewNodeNoInputConversion<CheckHoleyFloat64NotHoleOrUndefined>(
+            reducer_.current_block(),
+            BasicBlockPosition::At(state->node_index()), {phi});
+#ifdef DEBUG
+        eager_deopt_frame_ = nullptr;
+#endif  // DEBUG
+      }
+    } else {
+      DCHECK_EQ(from_repr, ValueRepresentation::kFloat64);
     }
+    conversion_is_truncating_float64 = true;
   }
 
   Opcode needed_conversion = GetOpcodeForConversion(
diff --git a/deps/v8/src/maglev/maglev-phi-representation-selector.h b/deps/v8/src/maglev/maglev-phi-representation-selector.h
index 5ecca6b95f2f..3007727a0999 100644
--- a/deps/v8/src/maglev/maglev-phi-representation-selector.h
+++ b/deps/v8/src/maglev/maglev-phi-representation-selector.h
@@ -206,7 +206,7 @@ class MaglevPhiRepresentationSelector {
       // removed altogether (or rather, replaced by an identity node).
       return UpdateUntaggingOfPhi(
           node->NodeBase::input(0).node()->template Cast<Phi>(),
-          node->template Cast<ValueNode>());
+          node->template Cast<ValueNode>(), state);
     }
     return ProcessResult::kContinue;
   }
@@ -273,7 +273,8 @@ class MaglevPhiRepresentationSelector {
 
   // Updates {old_untagging} to reflect that its Phi input has been untagged and
   // that a different conversion is now needed.
-  ProcessResult UpdateUntaggingOfPhi(Phi* phi, ValueNode* old_untagging);
+  ProcessResult UpdateUntaggingOfPhi(Phi* phi, ValueNode* old_untagging,
+                                     const ProcessingState* state);
 
   ProcessResult EmitUnconditionalDeopt(NodeBase* node, DeoptimizeReason reason);
 
diff --git a/deps/v8/src/maglev/maglev-range-analysis.h b/deps/v8/src/maglev/maglev-range-analysis.h
index 51744959af0f..57d415f06ed1 100644
--- a/deps/v8/src/maglev/maglev-range-analysis.h
+++ b/deps/v8/src/maglev/maglev-range-analysis.h
@@ -67,6 +67,18 @@ class NodeRanges {
     return *range;
   }
 
+  void InitializeRangeIfMissing(BasicBlock* block, ValueNode* node,
+                                Range range) {
+    DCHECK(ranges_initialized_.Contains(block->id()));
+    RangeMap& map = ranges_[block->id()];
+    if (!map.find(node)) {
+      map = map.insert(zone(), node, range);
+      TRACE_RANGE("Initializing in Block b" << block->id() << ": "
+                                            << PrintNodeBrief(node) << ": "
+                                            << range);
+    }
+  }
+
   void UnionUpdate(BasicBlock* block, ValueNode* node, Range range) {
     DCHECK(ranges_initialized_.Contains(block->id()));
     RangeMap& map = ranges_[block->id()];
@@ -210,6 +222,15 @@ class RangeProcessor {
   BlockProcessResult PreProcessBasicBlock(BasicBlock* block) {
     current_block_ = block;
     ranges_.EnsureMapExistsFor(block);
+    if (block->has_state() && block->state()->is_resumable_loop() &&
+        block->predecessor_count() == 1) {
+      // Resumable loop headers might not have a live forward predecessor: that
+      // part of the code might be dead even though the loop is still reachable
+      // via a resume point. Make sure we initialize phis in such case. If the
+      // loop has a live predecessor, ProcessPhis is called when processing that
+      // live predecessor, and this code is a no-op.
+      InitializeLoopPhisIfMissing(block);
+    }
     return BlockProcessResult::kContinue;
   }
   BlockProcessResult PostProcessBasicBlock(BasicBlock* block) {
@@ -543,6 +564,14 @@ class RangeProcessor {
     }
   }
 
+  void InitializeLoopPhisIfMissing(BasicBlock* block) {
+    if (!block->has_phi()) return;
+    for (Phi* phi : *block->phis()) {
+      ranges_.InitializeRangeIfMissing(
+          block, phi, phi->is_int32() ? Range::Int32() : Range::All());
+    }
+  }
+
   // Returns true if the loop reach a fixpoint.
   bool ProcessLoopPhisBackedge(BasicBlock* block, BasicBlock* backedge_pred) {
     if (!block->has_phi()) return true;
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index 034ef5f52ead..78ba29eeca3e 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -345,8 +345,8 @@ class StressOffThreadDeserializeThread final : public base::Thread {
     LocalIsolate local_isolate(isolate_, ThreadKind::kBackground);
     UnparkedScope unparked_scope(&local_isolate);
     LocalHandleScope handle_scope(&local_isolate);
-    off_thread_data_ =
-        CodeSerializer::StartDeserializeOffThread(&local_isolate, cached_data_);
+    CodeSerializer::StartDeserializeOffThread(&local_isolate, cached_data_,
+                                              &off_thread_data_);
   }
 
   MaybeDirectHandle<SharedFunctionInfo> Finalize(
@@ -360,7 +360,7 @@ class StressOffThreadDeserializeThread final : public base::Thread {
  private:
   Isolate* isolate_;
   AlignedCachedData* cached_data_;
-  CodeSerializer::OffThreadDeserializeData off_thread_data_;
+  OffThreadDeserializeData off_thread_data_;
 };
 
 void FinalizeDeserialization(Isolate* isolate,
@@ -554,8 +554,7 @@ MaybeDirectHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
   return scope.CloseAndEscape(result);
 }
 
-DirectHandle<Script> CodeSerializer::OffThreadDeserializeData::GetOnlyScript(
-    LocalHeap* heap) {
+DirectHandle<Script> OffThreadDeserializeData::GetOnlyScript(LocalHeap* heap) {
   std::unique_ptr<PersistentHandles> previous_persistent_handles =
       heap->DetachPersistentHandles();
   heap->AttachPersistentHandles(std::move(persistent_handles));
@@ -573,32 +572,47 @@ DirectHandle<Script> CodeSerializer::OffThreadDeserializeData::GetOnlyScript(
   return script;
 }
 
-CodeSerializer::OffThreadDeserializeData
-CodeSerializer::StartDeserializeOffThread(LocalIsolate* local_isolate,
-                                          AlignedCachedData* cached_data) {
-  OffThreadDeserializeData result;
-
+void CodeSerializer::StartDeserializeOffThread(LocalIsolate* local_isolate,
+                                               AlignedCachedData* cached_data,
+                                               OffThreadDeserializeData* data) {
   DCHECK(!local_isolate->heap()->HasPersistentHandles());
 
   const SerializedCodeData scd =
       SerializedCodeData::FromCachedDataWithoutSource(
-          local_isolate, cached_data, &result.sanity_check_result);
-  if (result.sanity_check_result != SerializedCodeSanityCheckResult::kSuccess) {
+          local_isolate, cached_data, &data->sanity_check_result);
+  if (data->sanity_check_result != SerializedCodeSanityCheckResult::kSuccess) {
     // Exit early but don't report yet, we'll re-check this when finishing on
     // the main thread
     DCHECK(cached_data->rejected());
-    return result;
+    return;
   }
 
   MaybeDirectHandle<SharedFunctionInfo> local_maybe_result =
       OffThreadObjectDeserializer::DeserializeSharedFunctionInfo(
-          local_isolate, &scd, &result.scripts);
+          local_isolate, &scd, &data->scripts);
 
-  result.maybe_result =
+  data->maybe_result =
       local_isolate->heap()->NewPersistentMaybeHandle(local_maybe_result);
-  result.persistent_handles = local_isolate->heap()->DetachPersistentHandles();
+  data->persistent_handles = local_isolate->heap()->DetachPersistentHandles();
+}
 
-  return result;
+bool CodeSerializer::NotifySourceTextAvailable(
+    Isolate* isolate, OffThreadDeserializeData* data,
+    const AlignedCachedData* cached_data, DirectHandle<String> source,
+    const ScriptDetails& script_details) {
+  HandleScope scope(isolate);
+
+  // Only check the source hash against the immutable cached_data header and
+  // write the main-thread-only data->source_sanity_check_result field here. Do
+  // not read/write data->sanity_check_result or mutate cached_data->Reject(),
+  // as StartDeserializeOffThread may still be running concurrently on a
+  // background thread. Full rejection and histogram reporting happen in
+  // FinishOffThreadDeserialize.
+  SerializedCodeData scd(cached_data);
+  SerializedCodeSanityCheckResult sanity_check_result =
+      scd.SanityCheckJustSource(isolate, source, script_details);
+  data->source_sanity_check_result = sanity_check_result;
+  return sanity_check_result == SerializedCodeSanityCheckResult::kSuccess;
 }
 
 MaybeDirectHandle<SharedFunctionInfo>
@@ -614,11 +628,6 @@ CodeSerializer::FinishOffThreadDeserialize(
 
   HandleScope scope(isolate);
 
-  DirectHandle<FixedArray> wrapped_arguments;
-  if (!script_details.wrapped_arguments.is_null()) {
-    wrapped_arguments = script_details.wrapped_arguments.ToHandleChecked();
-  }
-
   // Do a source sanity check now that we have the source. It's important for
   // FromPartiallySanityCheckedCachedData call that the sanity_check_result
   // holds the result of the off-thread sanity check.
@@ -626,10 +635,9 @@ CodeSerializer::FinishOffThreadDeserialize(
       data.sanity_check_result;
   const SerializedCodeData scd =
       SerializedCodeData::FromPartiallySanityCheckedCachedData(
-          cached_data,
-          SerializedCodeData::SourceHash(source, wrapped_arguments,
-                                         script_details.origin_options),
+          isolate, cached_data, data, source, script_details,
           &sanity_check_result);
+  USE(scd);
   if (sanity_check_result != SerializedCodeSanityCheckResult::kSuccess) {
     // The only case where the deserialization result could exist despite a
     // check failure is on a source mismatch, since we can't test for this
@@ -768,8 +776,22 @@ SerializedCodeSanityCheckResult SerializedCodeData::SanityCheck(
   return SanityCheckJustSource(expected_source_hash);
 }
 
+SerializedCodeSanityCheckResult SerializedCodeData::SanityCheckJustSource(
+    Isolate* isolate, DirectHandle<String> source,
+    const ScriptDetails& script_details) const {
+  DirectHandle<FixedArray> wrapped_arguments;
+  if (!script_details.wrapped_arguments.is_null()) {
+    wrapped_arguments = script_details.wrapped_arguments.ToHandleChecked();
+  }
+  return SanityCheckJustSource(
+      SourceHash(source, wrapped_arguments, script_details.origin_options));
+}
+
 SerializedCodeSanityCheckResult SerializedCodeData::SanityCheckJustSource(
     uint32_t expected_source_hash) const {
+  if (size_ < kHeaderSize) {
+    return SerializedCodeSanityCheckResult::kInvalidHeader;
+  }
   uint32_t source_hash = GetHeaderValue(kSourceHashOffset);
   if (source_hash != expected_source_hash) {
     return SerializedCodeSanityCheckResult::kSourceMismatch;
@@ -847,7 +869,7 @@ base::Vector<const uint8_t> SerializedCodeData::Payload() const {
   return base::Vector<const uint8_t>(payload, length);
 }
 
-SerializedCodeData::SerializedCodeData(AlignedCachedData* data)
+SerializedCodeData::SerializedCodeData(const AlignedCachedData* data)
     : SerializedData(const_cast<uint8_t*>(data->data()), data->length()) {}
 
 SerializedCodeData SerializedCodeData::FromCachedData(
@@ -882,12 +904,14 @@ SerializedCodeData SerializedCodeData::FromCachedDataWithoutSource(
 }
 
 SerializedCodeData SerializedCodeData::FromPartiallySanityCheckedCachedData(
-    AlignedCachedData* cached_data, uint32_t expected_source_hash,
+    Isolate* isolate, AlignedCachedData* cached_data,
+    const OffThreadDeserializeData& data, DirectHandle<String> source,
+    const ScriptDetails& script_details,
     SerializedCodeSanityCheckResult* rejection_result) {
-  DisallowGarbageCollection no_gc;
   // The previous call to FromCachedDataWithoutSource may have already rejected
   // the cached data, so reuse the previous rejection result if it's not a
   // success.
+  *rejection_result = data.sanity_check_result;
   if (*rejection_result != SerializedCodeSanityCheckResult::kSuccess) {
     // FromCachedDataWithoutSource doesn't check the source, so there can't be
     // a source mismatch.
@@ -897,7 +921,14 @@ SerializedCodeData SerializedCodeData::FromPartiallySanityCheckedCachedData(
     return SerializedCodeData(nullptr, 0);
   }
   SerializedCodeData scd(cached_data);
-  *rejection_result = scd.SanityCheckJustSource(expected_source_hash);
+  if (data.source_sanity_check_result.has_value()) {
+    DCHECK_EQ(*data.source_sanity_check_result,
+              scd.SanityCheckJustSource(isolate, source, script_details));
+    *rejection_result = *data.source_sanity_check_result;
+  } else {
+    *rejection_result =
+        scd.SanityCheckJustSource(isolate, source, script_details);
+  }
   if (*rejection_result != SerializedCodeSanityCheckResult::kSuccess) {
     // This check only checks the source, so the only possible failure is a
     // source mismatch.
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index ed2281113f4b..6cfafc4d26b1 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -5,6 +5,8 @@
 #ifndef V8_SNAPSHOT_CODE_SERIALIZER_H_
 #define V8_SNAPSHOT_CODE_SERIALIZER_H_
 
+#include <optional>
+
 #include "src/base/macros.h"
 #include "src/codegen/script-details.h"
 #include "src/snapshot/serializer.h"
@@ -57,21 +59,26 @@ typedef v8::ScriptCompiler::CachedData::CompatibilityCheckResult
 // histogram definition.
 static_assert(static_cast<int>(SerializedCodeSanityCheckResult::kLast) == 9);
 
-class CodeSerializer : public Serializer {
+class CodeSerializer;
+
+struct OffThreadDeserializeData {
  public:
-  struct OffThreadDeserializeData {
-   public:
-    bool HasResult() const { return !maybe_result.is_null(); }
-    DirectHandle<Script> GetOnlyScript(LocalHeap* heap);
-
-   private:
-    friend class CodeSerializer;
-    MaybeIndirectHandle<SharedFunctionInfo> maybe_result;
-    std::vector<IndirectHandle<Script>> scripts;
-    std::unique_ptr<PersistentHandles> persistent_handles;
-    SerializedCodeSanityCheckResult sanity_check_result;
-  };
+  bool HasResult() const { return !maybe_result.is_null(); }
+  DirectHandle<Script> GetOnlyScript(LocalHeap* heap);
+
+ private:
+  friend class CodeSerializer;
+  friend class SerializedCodeData;
+  MaybeIndirectHandle<SharedFunctionInfo> maybe_result;
+  std::vector<IndirectHandle<Script>> scripts;
+  std::unique_ptr<PersistentHandles> persistent_handles;
+  SerializedCodeSanityCheckResult sanity_check_result =
+      SerializedCodeSanityCheckResult::kSuccess;
+  std::optional<SerializedCodeSanityCheckResult> source_sanity_check_result;
+};
 
+class CodeSerializer : public Serializer {
+ public:
   CodeSerializer(const CodeSerializer&) = delete;
   CodeSerializer& operator=(const CodeSerializer&) = delete;
   V8_EXPORT_PRIVATE static ScriptCompiler::CachedData* Serialize(
@@ -85,9 +92,14 @@ class CodeSerializer : public Serializer {
               DirectHandle<String> source, const ScriptDetails& script_details,
               MaybeDirectHandle<Script> maybe_cached_script = {});
 
-  V8_WARN_UNUSED_RESULT static OffThreadDeserializeData
-  StartDeserializeOffThread(LocalIsolate* isolate,
-                            AlignedCachedData* cached_data);
+  static void StartDeserializeOffThread(LocalIsolate* isolate,
+                                        AlignedCachedData* cached_data,
+                                        OffThreadDeserializeData* data);
+
+  V8_WARN_UNUSED_RESULT static bool NotifySourceTextAvailable(
+      Isolate* isolate, OffThreadDeserializeData* data,
+      const AlignedCachedData* cached_data, DirectHandle<String> source,
+      const ScriptDetails& script_details);
 
   V8_WARN_UNUSED_RESULT static MaybeDirectHandle<SharedFunctionInfo>
   FinishOffThreadDeserialize(
@@ -140,7 +152,9 @@ class SerializedCodeData : public SerializedData {
   // FromCachedDataWithoutSource. The rejection result from that call should be
   // passed into this one.
   static SerializedCodeData FromPartiallySanityCheckedCachedData(
-      AlignedCachedData* cached_data, uint32_t expected_source_hash,
+      Isolate* isolate, AlignedCachedData* cached_data,
+      const OffThreadDeserializeData& data, DirectHandle<String> source,
+      const ScriptDetails& script_details,
       SerializedCodeSanityCheckResult* rejection_result);
 
   // Used when producing.
@@ -157,7 +171,8 @@ class SerializedCodeData : public SerializedData {
                              ScriptOriginOptions origin_options);
 
  private:
-  explicit SerializedCodeData(AlignedCachedData* data);
+  friend class CodeSerializer;
+  explicit SerializedCodeData(const AlignedCachedData* data);
   SerializedCodeData(const uint8_t* data, int size)
       : SerializedData(const_cast<uint8_t*>(data), size) {}
 
@@ -169,6 +184,9 @@ class SerializedCodeData : public SerializedData {
   SerializedCodeSanityCheckResult SanityCheck(
       uint32_t expected_ro_snapshot_checksum,
       uint32_t expected_source_hash) const;
+  SerializedCodeSanityCheckResult SanityCheckJustSource(
+      Isolate* isolate, DirectHandle<String> source,
+      const ScriptDetails& script_details) const;
   SerializedCodeSanityCheckResult SanityCheckJustSource(
       uint32_t expected_source_hash) const;
   SerializedCodeSanityCheckResult SanityCheckWithoutSource(
diff --git a/deps/v8/test/mjsunit/maglev/regress-564326894.js b/deps/v8/test/mjsunit/maglev/regress-564326894.js
new file mode 100644
index 000000000000..0a48ca5b224a
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-564326894.js
@@ -0,0 +1,29 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+const arr = [1.5, ,];
+
+function foo(a) {
+  let x = a[0];
+  let y = a[0];
+  for (let i = 0; i < 5; i++) {
+    const t = (y | 0) + y;
+    y = x;
+    x = t;
+  }
+  return x;
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(8.5, foo(arr));
+assertEquals(8.5, foo(arr));
+%OptimizeMaglevOnNextCall(foo);
+assertEquals(8.5, foo(arr));
+assertOptimized(foo);
+
+// Passing a hole when feedback only saw Number must still deopt and return NaN.
+assertEquals(NaN, foo([, 1.5]));
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/maglev/regress-569286602-1.js b/deps/v8/test/mjsunit/maglev/regress-569286602-1.js
new file mode 100644
index 000000000000..b89ebdcb4828
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-569286602-1.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f(r) {
+  let pos;
+  while ('a'.startsWith('b', pos)) { do { pos = 1; } while (pos); }
+  r.push(pos);
+}
+
+%PrepareFunctionForOptimization(f);
+let a = [{}];
+assertEquals(undefined, f(a));
+assertEquals([{}, undefined], a);
+let b = [1];
+assertEquals(undefined, f(b));
+assertEquals([1, undefined], b);
+
+%OptimizeMaglevOnNextCall(f);
+let c = [1];
+assertEquals(undefined, f(c));
+assertEquals([1, undefined], c);
diff --git a/deps/v8/test/mjsunit/maglev/regress-569286602-2.js b/deps/v8/test/mjsunit/maglev/regress-569286602-2.js
new file mode 100644
index 000000000000..dc186b862a9b
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-569286602-2.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f(r) {
+  let pos;
+  while ('a'.startsWith('b', pos)) { do { pos = 1; } while (pos); }
+  if (r) r.push(pos);
+}
+
+%PrepareFunctionForOptimization(f);
+let a = [{}];
+assertEquals(undefined, f(a));
+assertEquals([{}, undefined], a);
+let b = [1];
+assertEquals(undefined, f(b));
+assertEquals([1, undefined], b);
+
+%OptimizeMaglevOnNextCall(f);
+let c = [1];
+assertEquals(undefined, f(c));
+assertEquals([1, undefined], c);
diff --git a/deps/v8/test/mjsunit/regress/regress-566091009.js b/deps/v8/test/mjsunit/regress/regress-566091009.js
new file mode 100644
index 000000000000..aaf8c217d3c7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-566091009.js
@@ -0,0 +1,69 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy-feedback-allocation --allow-natives-syntax
+
+(function TestAccessCheck() {
+  const target = d8.test.createAccessCheckedObject(true);
+  target[0] = "secret";
+  d8.test.setAccessPolicy(target, false);
+
+  const namedObj = { a: 1 };
+
+  // 1. KeyedLoadIC: transition from named property access to element access.
+  function read(obj, key) {
+    return obj[key];
+  }
+  read(namedObj, "a");
+  assertThrows(() => read(target, "a"), TypeError);
+  read([1.1], 0);
+  assertThrows(() => read(target, 0), TypeError);
+
+  // 2. KeyedHasIC: transition from named property access to element access.
+  function has(obj, key) {
+    return key in obj;
+  }
+  has(namedObj, "a");
+  assertThrows(() => has(target, "a"), TypeError);
+  has([1.1], 0);
+  assertThrows(() => has(target, 0), TypeError);
+
+  // 3. KeyedStoreIC: transition from named property access to element access.
+  function write(obj, key, val) {
+    obj[key] = val;
+  }
+  write(namedObj, "a", 2);
+  assertThrows(() => write(target, "a", 2), TypeError);
+  write([1.1], 0, 2.2);
+  assertThrows(() => write(target, 0, "overwritten"), TypeError);
+
+  d8.test.setAccessPolicy(target, true);
+  assertEquals("secret", target[0]);
+})();
+
+(function TestNoElementsProtector() {
+  function readHole(a) {
+    return a[0];
+  }
+  const holey = [, 1];
+  %PrepareFunctionForOptimization(readHole);
+  assertEquals(undefined, readHole(holey));
+  %OptimizeFunctionOnNextCall(readHole);
+  assertEquals(undefined, readHole(holey));
+
+  Object.defineProperty(Object.prototype, "prop", {
+    set(_) {},
+    configurable: true,
+  });
+  function write(o, k, v) {
+    o[k] = v;
+  }
+  write({ prop: 1 }, "prop", 1);
+  write(Array.prototype, "prop", 1);
+  write([], 0, 1);
+  write(Array.prototype, 0, "boom");
+
+  assertEquals("boom", holey[0]);
+  assertEquals("boom", readHole(holey));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-570003644-1.js b/deps/v8/test/mjsunit/regress/regress-570003644-1.js
new file mode 100644
index 000000000000..f56634f7a54b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-570003644-1.js
@@ -0,0 +1,110 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev-non-eager-inlining --expose-gc --allow-natives-syntax
+
+class D {
+  constructor(x) {
+    this.x = x;
+    this.p = 7;
+    this.q = 9;
+  }
+}
+
+// Map: MD1 where x is const SMI
+let dOld = new D(1);
+
+// Map: MD2 (after adding "tail")
+// Map transition: MD1 --tail--> MD2
+let dExtra = new D(1);
+dExtra.tail = 1;
+
+class C {
+  constructor(z) {
+    this.z = z;
+    this.q = 11;
+  }
+}
+
+// Map: MC1 where z is a const SMI
+let cOld = new C(1);
+
+// Map: MC2 w where z is a const HeapNumber
+let cTarget = new C(1.5);
+
+// Migrate to MC2: this makes MC2 a migration target
+cOld.z = 2.5;
+
+// Larger than the eager-inline bytecode limit.
+function noop() {
+  let n = 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  return n;
+}
+%PrepareFunctionForOptimization(noop);
+
+function polyQ(o) {
+  noop(); // Not inlined
+  // MigrateMapIfNeeded, then a polymorphic branch with MC2 and MD1 (in this
+  // order).
+  return o.q;
+}
+%PrepareFunctionForOptimization(polyQ);
+
+polyQ(cTarget);
+polyQ(dOld);
+
+let smi_array = [0, 0];
+
+function victim(cObj, dObj) {
+  // CheckMapsWithMigration(MC2) cObj; tries to migrate to MC2 (but the cTarget we
+  // pass already has MC2).
+  cObj.q;
+
+  // CheckMaps(MD1) dObj
+  dObj.p;
+
+  // Eagerly inlining polyQ. Here we need to conservatively assume that the noop
+  // call might change the maps, so we get:
+  // CallFunction noop
+  // MigrateMapIfNeeded dObj
+  // Polymoprhic branch (MC2, MD1):
+  // /-- Branch if dObj's map is MC2
+  // |      |
+  // |      v
+  // |   CheckMap(MD1) dObj <<< Load-bearing! Must not be eliminated
+  // |      |
+  // |      v
+  // \--> Result unused, so this is empty
+  polyQ(dObj);
+
+  // The map better be MD1 or this goes wrong.
+  smi_array[0] = dObj.x;
+}
+%PrepareFunctionForOptimization(victim);
+victim(cTarget, dOld);
+
+%OptimizeMaglevOnNextCall(victim);
+
+victim(cTarget, dOld);
+
+// Move the smi_array backing store to old space before storing a young pointer.
+gc();
+
+// Create a new map MD3 where x is a HeapNumber; MD1 deprecated.
+new D(1.5);
+
+// Now the MigrateMapIfNeeded will migrate dOld to MD3 where x is a HeapNumber.
+victim(cTarget, dOld);
diff --git a/deps/v8/test/mjsunit/regress/regress-570003644-2.js b/deps/v8/test/mjsunit/regress/regress-570003644-2.js
new file mode 100644
index 000000000000..fe9c96dd215b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-570003644-2.js
@@ -0,0 +1,111 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev-non-eager-inlining --expose-gc --allow-natives-syntax
+// Flags: --max-maglev-eager-inlined-bytecode-size=0
+
+class D {
+  constructor(x) {
+    this.x = x;
+    this.p = 7;
+    this.q = 9;
+  }
+}
+
+// Map: MD1 where x is const SMI
+let dOld = new D(1);
+
+// Map: MD2 (after adding "tail")
+// Map transition: MD1 --tail--> MD2
+let dExtra = new D(1);
+dExtra.tail = 1;
+
+class C {
+  constructor(z) {
+    this.z = z;
+    this.q = 11;
+  }
+}
+
+// Map: MC1 where z is a const SMI
+let cOld = new C(1);
+
+// Map: MC2 w where z is a const HeapNumber
+let cTarget = new C(1.5);
+
+// Migrate to MC2: this makes MC2 a migration target
+cOld.z = 2.5;
+
+// Larger than the eager-inline bytecode limit.
+function noop() {
+  let n = 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  n += 0;
+  return n;
+}
+%PrepareFunctionForOptimization(noop);
+
+function polyQ(o) {
+  noop(); // Not inlined
+  // MigrateMapIfNeeded, then a polymorphic branch with MC2 and MD1 (in this
+  // order).
+  return o.q;
+}
+%PrepareFunctionForOptimization(polyQ);
+
+polyQ(cTarget);
+polyQ(dOld);
+
+let smi_array = [0, 0];
+
+function victim(cObj, dObj) {
+  // CheckMapsWithMigration(MC2) cObj; tries to migrate to MC2 (but the cTarget we
+  // pass already has MC2).
+  cObj.q;
+
+  // CheckMaps(MD1) dObj
+  dObj.p;
+
+  // Eventually we'l inline polyQ here. Here we need to conservatively assume
+  // that the noop call might change the maps, so we get:
+  // CallFunction noop
+  // MigrateMapIfNeeded dObj
+  // Polymoprhic branch (MC2, MD1):
+  // /-- Branch if dObj's map is MC2
+  // |      |
+  // |      v
+  // |   CheckMap(MD1) dObj <<< Load-bearing! Must not be eliminated
+  // |      |
+  // |      v
+  // \--> Result unused, so this is empty
+  polyQ(dObj);
+
+  // The map better be MD1 or this goes wrong.
+  smi_array[0] = dObj.x;
+}
+%PrepareFunctionForOptimization(victim);
+victim(cTarget, dOld);
+
+%OptimizeMaglevOnNextCall(victim);
+
+victim(cTarget, dOld);
+
+// Move the smi_array backing store to old space before storing a young pointer.
+gc();
+
+// Create a new map MD3 where x is a HeapNumber; MD1 deprecated.
+new D(1.5);
+
+// Now the MigrateMapIfNeeded will migrate dOld to MD3 where x is a HeapNumber.
+victim(cTarget, dOld);
diff --git a/deps/v8/test/mjsunit/regress/regress-570203091-1.js b/deps/v8/test/mjsunit/regress/regress-570203091-1.js
new file mode 100644
index 000000000000..2ac6c407c776
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-570203091-1.js
@@ -0,0 +1,29 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbolev --allow-natives-syntax
+
+let sink = 0;
+function* gen() {
+  try { unknown_global; } catch {}
+  let x = 0;
+  for (;;) {
+    if (x === 0) {
+      sink = 1;
+    } else {
+      sink = 2;
+    }
+    const is_zero = x === 0 ? true : false;
+    x = (yield is_zero).length;
+  }
+}
+
+%PrepareFunctionForOptimization(gen);
+const g = gen();
+g.next();     // x = 0
+g.next("a");  // x = 1
+g.next("");   // x = 0
+
+%OptimizeFunctionOnNextCall(gen);
+assertEquals(false, g.next("hello").value);
diff --git a/deps/v8/test/mjsunit/regress/regress-570203091-2.js b/deps/v8/test/mjsunit/regress/regress-570203091-2.js
new file mode 100644
index 000000000000..f99037288cda
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-570203091-2.js
@@ -0,0 +1,35 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbolev --allow-natives-syntax
+
+let sink = 0;
+const arr = [1.1, 2.2];
+const victim = [3.3];
+
+function* gen() {
+  try { unknown_global; } catch {}
+  let x = 0;
+  for (;;) {
+    if (x === 0) {
+      sink = 1;
+    } else {
+      sink = 2;
+    }
+    if (arr.length <= 0) return;
+    arr[x] = 1.5;
+    x = (yield).length;
+  }
+}
+
+%PrepareFunctionForOptimization(gen);
+const g = gen();
+g.next();     // x = 0
+g.next("a");  // x = 1
+g.next("");   // x = 0
+
+%OptimizeFunctionOnNextCall(gen);
+g.next("abcdef");
+assertEquals(3.3, victim[0]);
+assertEquals(7, arr.length);
diff --git a/deps/v8/test/unittests/api/deserialize-unittest.cc b/deps/v8/test/unittests/api/deserialize-unittest.cc
index ecd607e46fe9..fb9fb9983b7d 100644
--- a/deps/v8/test/unittests/api/deserialize-unittest.cc
+++ b/deps/v8/test/unittests/api/deserialize-unittest.cc
@@ -1333,4 +1333,148 @@ TEST_F(MergeDeserializedCodeTest, MergeThatStartsButDoesNotFinish) {
   }
 }
 
+TEST_F(MergeDeserializedCodeTest, ModuleCacheClassicScriptMismatch) {
+  i::v8_flags.merge_background_deserialized_script_with_compilation_cache =
+      true;
+  std::unique_ptr<v8::ScriptCompiler::CachedData> cached_data;
+  IsolateAndContextScope scope(this);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate());
+  PersistentScriptOrigin default_origin(
+      isolate(), NewString("http://example.com/test.js"));
+
+  constexpr char kPolyglotSource[] =
+      "let L0 = 1;\n"
+      "var z, o;\n"
+      "function g() { throw 1; }\n"
+      "function K(a, b) { var t = globalThis.top; (t.__keep = t.__keep || "
+      "[]).push(a, b); }\n"
+      "z = await /1; function lazyOuter() { function inner() {} } { try { g() "
+      "} catch /* 1, o = { a: function () {}, 'NAMENAMENAMENAME' //*/\n"
+      "(e) { K(() => e, function later() { return e }) } }\n";
+
+  // Setup: define `await` and `top` in global scope for classic script parse.
+  {
+    v8::HandleScope handle_scope(isolate());
+    Local<Script> setup =
+        Script::Compile(
+            context(), NewString("var await = 6; globalThis.top = globalThis;"))
+            .ToLocalChecked();
+    CHECK(!setup->Run(context()).IsEmpty());
+  }
+
+  // Step 1: Compile and run as a classic script, populating the Isolate
+  // compilation cache and retaining catch-block closures in globalThis.__keep.
+  // Also compile as a module with the same resource name and create a module
+  // code cache, then age and flush the classic script's top-level bytecode.
+  {
+    v8::HandleScope handle_scope(isolate());
+    ScriptOrigin classic_origin = default_origin.AsScriptOrigin();
+    Local<Script> script =
+        Script::Compile(context(), NewString(kPolyglotSource), &classic_origin)
+            .ToLocalChecked();
+    CHECK(!script->Run(context()).IsEmpty());
+
+    ScriptOrigin module_origin(NewString("http://example.com/test.js"), 0, 0,
+                               false, -1, Local<Value>(), false, false,
+                               /*is_module=*/true);
+    ScriptCompiler::Source module_source(NewString(kPolyglotSource),
+                                         module_origin);
+    Local<Module> module =
+        ScriptCompiler::CompileModule(isolate(), &module_source)
+            .ToLocalChecked();
+    cached_data.reset(
+        ScriptCompiler::CreateCodeCache(module->GetUnboundModuleScript()));
+
+    i::SharedFunctionInfo::EnsureOldForTesting(GetSharedFunctionInfo(script));
+  }
+
+  // Step 2: Flush the classic script's top-level bytecode via major GC.
+  {
+    i::DisableConservativeStackScanningScopeForTesting no_css_scope(
+        i_isolate->heap());
+    InvokeMajorGC(i_isolate);
+    InvokeMajorGC(i_isolate);
+  }
+
+  // Step 3a: Start off-thread consumption of the MODULE code cache, then notify
+  // SourceTextAvailable with the CLASSIC ScriptOrigin after Run() completes.
+  {
+    auto task_cached_data = std::make_unique<ScriptCompiler::CachedData>(
+        cached_data->data, cached_data->length,
+        ScriptCompiler::CachedData::BufferNotOwned);
+    DeserializeThread deserialize_thread(
+        ScriptCompiler::StartConsumingCodeCache(
+            isolate(), std::make_unique<ScriptCompiler::CachedData>(
+                           cached_data->data, cached_data->length,
+                           ScriptCompiler::CachedData::BufferNotOwned)));
+    CHECK(deserialize_thread.Start());
+    deserialize_thread.Join();
+
+    std::unique_ptr<ScriptCompiler::ConsumeCodeCacheTask> task =
+        deserialize_thread.TakeTask();
+    task->SourceTextAvailable(isolate(), NewString(kPolyglotSource),
+                              default_origin.AsScriptOrigin());
+    CHECK(!task->ShouldMergeWithExistingScript());
+
+    v8::HandleScope handle_scope(isolate());
+    ScriptCompiler::Source source(NewString(kPolyglotSource),
+                                  default_origin.AsScriptOrigin(),
+                                  task_cached_data.release(), task.release());
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    CHECK(!script.IsEmpty());
+    CHECK(source.GetCachedData()->rejected);
+
+    // Age and flush the recompiled classic script's top-level bytecode again so
+    // Step 3b also sees a flushed Script in the Isolate compilation cache.
+    i::SharedFunctionInfo::EnsureOldForTesting(GetSharedFunctionInfo(script));
+  }
+  {
+    i::DisableConservativeStackScanningScopeForTesting no_css_scope(
+        i_isolate->heap());
+    InvokeMajorGC(i_isolate);
+    InvokeMajorGC(i_isolate);
+  }
+
+  // Step 3b: Also test calling SourceTextAvailable on the main thread BEFORE
+  // Run() executes on the background thread.
+  {
+    auto task_cached_data = std::make_unique<ScriptCompiler::CachedData>(
+        cached_data->data, cached_data->length,
+        ScriptCompiler::CachedData::BufferNotOwned);
+    std::unique_ptr<ScriptCompiler::ConsumeCodeCacheTask> task(
+        ScriptCompiler::StartConsumingCodeCache(
+            isolate(), std::make_unique<ScriptCompiler::CachedData>(
+                           cached_data->data, cached_data->length,
+                           ScriptCompiler::CachedData::BufferNotOwned)));
+    task->SourceTextAvailable(isolate(), NewString(kPolyglotSource),
+                              default_origin.AsScriptOrigin());
+
+    DeserializeThread deserialize_thread(task.release());
+    CHECK(deserialize_thread.Start());
+    deserialize_thread.Join();
+    task = deserialize_thread.TakeTask();
+    CHECK(!task->ShouldMergeWithExistingScript());
+
+    v8::HandleScope handle_scope(isolate());
+    ScriptCompiler::Source source(NewString(kPolyglotSource),
+                                  default_origin.AsScriptOrigin(),
+                                  task_cached_data.release(), task.release());
+    Local<Script> script =
+        ScriptCompiler::Compile(context(), &source,
+                                ScriptCompiler::kConsumeCodeCache)
+            .ToLocalChecked();
+    CHECK(!script.IsEmpty());
+    CHECK(source.GetCachedData()->rejected);
+
+    Local<Script> run_kept =
+        Script::Compile(context(),
+                        NewString("for (const f of globalThis.__keep) f();"))
+            .ToLocalChecked();
+    CHECK(!run_kept->Run(context()).IsEmpty());
+  }
+}
+
 }  // namespace v8