deps: patch V8 to 14.3.127.4

Refs: v8/v8@14.3.127.2...14.3.127.4

Author: targos

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 14
 #define V8_MINOR_VERSION 3
 #define V8_BUILD_NUMBER 127
-#define V8_PATCH_LEVEL 2
+#define V8_PATCH_LEVEL 4
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc

@@ -5819,19 +5819,14 @@ void InstructionSelector::VisitI8x16Shuffle(OpIndex node) {
     int lane_size = kBitsPerByte * kSimd128Size / lanes;
     Emit(kArm64S128Dup | LaneSizeField::encode(lane_size), dup,
          g.UseRegister(dup_input), g.UseImmediate(dup_index));
-    if (is_swizzle) {
-      Emit(shuffle_op, g.DefineAsRegister(node), g.UseRegister(input0), dup);
-      return;
-    } else {
-      // For non-swizzles, we first need to perform the shuffles with the two
-      // original inputs, into a temp register.
-      InstructionOperand temp = g.TempSimd128Register();
-      Emit(shuffle_op, temp, g.UseRegister(input0), g.UseRegister(input1));
-      // Then we need to move the dup result into the top 8 bytes.
-      Emit(kArm64S128MoveLane | LaneSizeField::encode(64),
-           g.DefineSameAsFirst(node), temp, dup, g.UseImmediate(1),
-           g.UseImmediate(1));
-    }
+    // First need to perform the shuffles with the two original inputs, into a
+    // temp register.
+    InstructionOperand temp = g.TempSimd128Register();
+    Emit(shuffle_op, temp, g.UseRegister(input0), g.UseRegister(input1));
+    // Then we need to move the dup result into the top 8 bytes.
+    Emit(kArm64S128MoveLane | LaneSizeField::encode(64),
+         g.DefineSameAsFirst(node), temp, dup, g.UseImmediate(1),
+         g.UseImmediate(1));
   };
 
   std::array<uint8_t, kSimd128HalfSize> bottom_shuffle;

deps/v8/src/maglev/maglev-graph-builder.cc

@@ -4495,14 +4495,17 @@ ValueNode* MaglevGraphBuilder::ConvertForField(ValueNode* value,
                                                AllocationType allocation_type) {
   switch (desc.type) {
     case vobj::FieldType::kTagged: {
-      if (NodeTypeIs(GetType(value), NodeType::kSmi)) {
+      // Subtle: we don't use `NodeTypeIs(...)` since the predicate must NOT
+      // be true for NodeType::kNone.
+      // TODO(jgruber): NodeType::kNone should never reach here.
+      if (GetType(value) == NodeType::kSmi) {
         // TODO(jgruber): This is needed because HoleyFloat64ToTagged does not
         // canonicalize smis by default in GetTaggedValue. We rely on
         // canonicalization though in TryReduceConstructArrayConstructor.
         // We should make this more robust.
         MaybeReduceResult res = GetSmiValue(value);
-        DCHECK(res.IsDoneWithPayload());
-        return res.node()->Cast<ValueNode>();
+        CHECK(res.IsDoneWithValue());
+        return res.value();
       }
       if (value->Is<Float64Constant>()) {
         // Note that NodeType::kSmi MUST go through GetSmiValue for proper

deps/v8/test/mjsunit/regress/regress-454861480.js

@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+function f0() {
+  try {
+    ([f0,f0]).forEach(undefined);
+    class C4 {
+      [undefined];
+    }
+  } catch(e5) {
+  }
+  return f0;
+}
+const v6 = %PrepareFunctionForOptimization(f0);
+f0();
+const v8 = %OptimizeMaglevOnNextCall(f0);
+f0();

deps/v8/test/mjsunit/regress/regress-454943951.js

@@ -0,0 +1,19 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function* __f_0(__v_1) {
+  for (let __v_2 = 0; __v_2 < __v_1; __v_2++) {
+    for (let __v_3 = 0; __v_3 < __v_1; __v_3++) {
+      Math.acos(false);
+      yield __v_2 * 10 + __v_3;
+    }
+  }
+}
+%PrepareFunctionForOptimization(__f_0);
+let __v_0 = __f_0(4);
+__v_0.next().value;
+%OptimizeFunctionOnNextCall(__f_0);
+__v_0 = __f_0();

deps/v8/test/mjsunit/wasm/half-dup-shuffles.js

@@ -54,12 +54,14 @@ function Test(config) {
 
 (function SplatAndShuffleTest(config) {
   const dup_byte_0 = [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ]
+  const dup_half_0 = [0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01 ]
   const dup_half_8 = [0x10, 0x11, 0x10, 0x11, 0x10, 0x11, 0x10, 0x11 ]
   const dup_word_1 = [0x04, 0x05, 0x06, 0x07, 0x04, 0x05, 0x06, 0x07 ]
 
   const even_bytes = [0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e ]
   const interleave_high_halves = [0x08, 0x09, 0x18, 0x19, 0x0a, 0x0b, 0x1a, 0x1b ]
   const transpose_odd_words = [0x04, 0x05, 0x06, 0x07, 0x14, 0x15, 0x16, 0x17 ]
+  const reverse_16x2 = [0x02, 0x03, 0x00, 0x01, 0x06, 0x07, 0x04, 0x05 ]
 
   const splat_and_shuffle_tests =[
     {
@@ -77,6 +79,11 @@ function Test(config) {
       dup_shuffle: dup_word_1,
       shuffle: transpose_odd_words,
     },
+    {
+      name: "dup and reverse 16x2",
+      dup_shuffle: dup_half_0,
+      shuffle: reverse_16x2,
+    },
   ];
 
   for (const config of splat_and_shuffle_tests) {

deps/v8/test/unittests/compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc

@@ -3627,23 +3627,23 @@ std::ostream& operator<<(std::ostream& os, const DupAndShuffleInst& inst) {
 const DupAndShuffleInst kDupAndShuffles[] = {
     {"Dup 0 and UnzipLeft",
      kArm64S128UnzipLeft,
-     2,
+     3,
      0,
      16,
      0,
      true,
      {{0, 1, 4, 5, 8, 9, 12, 13, 0, 1, 0, 1, 0, 1, 0, 1}}},
     {"Dup 1 and UnzipLeft",
      kArm64S128UnzipLeft,
-     2,
+     3,
      0,
      16,
      1,
      true,
      {{0, 1, 4, 5, 8, 9, 12, 13, 2, 3, 2, 3, 2, 3, 2, 3}}},
     {"Dup 0 and UnzipRight",
      kArm64S128UnzipRight,
-     2,
+     3,
      0,
      16,
      0,
@@ -3738,28 +3738,29 @@ TEST_P(TurboshaftInstructionSelectorDupAndShuffleTest, DupAndShuffle) {
   Stream s = m.Build();
   EXPECT_EQ(inst.expected_num_insts, s.size());
 
-  if (inst.expected_num_insts > 1) {
+  if (inst.expected_num_insts == 3) {
+    // The dup
     EXPECT_EQ(kArm64S128Dup, s[0]->arch_opcode());
+    EXPECT_EQ(inst.lane_size, LaneSizeField::decode(s[0]->opcode()));
     EXPECT_EQ(s.ToVreg(s[0]->InputAt(0)),
               s.ToVreg(m.Parameter(inst.expected_param_index)));
     EXPECT_EQ(s.ToInt32(s[0]->InputAt(1)), inst.index);
 
-    EXPECT_EQ(inst.lane_size, LaneSizeField::decode(s[0]->opcode()));
+    // The shuffle
     EXPECT_EQ(inst.arch_opcode, s[1]->arch_opcode());
     EXPECT_EQ(inst.lane_size, LaneSizeField::decode(s[1]->opcode()));
-
-    if (inst.expected_num_insts == 3) {
-      EXPECT_EQ(s.ToVreg(s[1]->InputAt(0)), s.ToVreg(m.Parameter(0)));
-      EXPECT_EQ(s.ToVreg(s[1]->InputAt(1)), s.ToVreg(m.Parameter(1)));
-      EXPECT_EQ(kArm64S128MoveLane, s[2]->arch_opcode());
-      EXPECT_EQ(1U, s[2]->OutputCount());
+    EXPECT_EQ(s.ToVreg(s[1]->InputAt(0)), s.ToVreg(m.Parameter(0)));
+    if (inst.is_swizzle) {
+      EXPECT_EQ(s.ToVreg(s[1]->InputAt(1)), s.ToVreg(m.Parameter(0)));
     } else {
-      EXPECT_EQ(s.ToVreg(s[1]->InputAt(0)),
-                s.ToVreg(m.Parameter(inst.expected_param_index)));
-      EXPECT_EQ(s.ToVreg(s[1]->InputAt(1)), s.ToVreg(s[0]->Output()));
-      EXPECT_EQ(1U, s[1]->OutputCount());
+      EXPECT_EQ(s.ToVreg(s[1]->InputAt(1)), s.ToVreg(m.Parameter(1)));
     }
+
+    // Copy the top half of the dup into the result register.
+    EXPECT_EQ(kArm64S128MoveLane, s[2]->arch_opcode());
+    EXPECT_EQ(1U, s[2]->OutputCount());
   } else {
+    DCHECK_EQ(inst.expected_num_insts, 1);
     EXPECT_EQ(inst.arch_opcode, s[0]->arch_opcode());
   }
 }