deps: patch V8 to 14.4.258.15

Refs: v8/v8@14.4.258.13...14.4.258.15

Author: targos

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 14
 #define V8_MINOR_VERSION 4
 #define V8_BUILD_NUMBER 258
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 15
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/maglev/arm/maglev-ir-arm.cc

@@ -957,18 +957,26 @@ int CheckJSDataViewBounds::MaxCallStackArgs() const { return 1; }
 void CheckJSDataViewBounds::SetValueLocationConstraints() {
   UseRegister(IndexInput());
   UseRegister(ByteLengthInput());
+  int element_size = compiler::ExternalArrayElementSize(element_type_);
+  if (element_size > 1) {
+    set_temporaries_needed(1);
+  }
 }
 void CheckJSDataViewBounds::GenerateCode(MaglevAssembler* masm,
                                          const ProcessingState& state) {
   Register index = ToRegister(IndexInput());
   Register byte_length = ToRegister(ByteLengthInput());
 
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  Register limit = byte_length;
+
   int element_size = compiler::ExternalArrayElementSize(element_type_);
   if (element_size > 1) {
-    __ sub(byte_length, byte_length, Operand(element_size - 1), SetCC);
+    limit = temps.Acquire();
+    __ sub(limit, byte_length, Operand(element_size - 1), SetCC);
     __ EmitEagerDeoptIf(mi, DeoptimizeReason::kOutOfBounds, this);
   }
-  __ cmp(index, byte_length);
+  __ cmp(index, limit);
   __ EmitEagerDeoptIf(hs, DeoptimizeReason::kOutOfBounds, this);
 }
 

deps/v8/src/maglev/arm64/maglev-ir-arm64.cc

@@ -931,18 +931,26 @@ int CheckJSDataViewBounds::MaxCallStackArgs() const { return 1; }
 void CheckJSDataViewBounds::SetValueLocationConstraints() {
   UseRegister(IndexInput());
   UseRegister(ByteLengthInput());
+  int element_size = compiler::ExternalArrayElementSize(element_type_);
+  if (element_size > 1) {
+    set_temporaries_needed(1);
+  }
 }
 void CheckJSDataViewBounds::GenerateCode(MaglevAssembler* masm,
                                          const ProcessingState& state) {
   Register index = ToRegister(IndexInput());
   Register byte_length = ToRegister(ByteLengthInput());
 
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  Register limit = byte_length;
+
   int element_size = compiler::ExternalArrayElementSize(element_type_);
   if (element_size > 1) {
-    __ Subs(byte_length, byte_length, Immediate(element_size - 1));
+    limit = temps.Acquire();
+    __ Subs(limit, byte_length, Immediate(element_size - 1));
     __ EmitEagerDeoptIf(mi, DeoptimizeReason::kOutOfBounds, this);
   }
-  __ Cmp(index, byte_length);
+  __ Cmp(index, limit);
   __ EmitEagerDeoptIf(hs, DeoptimizeReason::kOutOfBounds, this);
 }
 

deps/v8/src/maglev/x64/maglev-ir-x64.cc

@@ -93,7 +93,12 @@ void LoadTypedArrayLength::GenerateCode(MaglevAssembler* masm,
 
 void CheckJSDataViewBounds::SetValueLocationConstraints() {
   UseRegister(IndexInput());
-  UseRegister(ByteLengthInput());
+  int element_size = compiler::ExternalArrayElementSize(element_type_);
+  if (element_size > 1) {
+    UseAndClobberRegister(ByteLengthInput());
+  } else {
+    UseRegister(ByteLengthInput());
+  }
 }
 
 void CheckJSDataViewBounds::GenerateCode(MaglevAssembler* masm,

deps/v8/test/mjsunit/maglev/dataview-almost-oob.js

@@ -0,0 +1,28 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+let ab = new ArrayBuffer(7);
+let dv = new DataView(ab);
+
+/* -----------------------------
+   | 0 | 1 | 2 | 3 | 4 | 5 | 6 | << the ArrayBuffer
+   -----------------------------
+
+                           ---------
+                           | X | X | << trying to access size 2 element at index 6
+                           ---------
+*/
+
+function foo(dv) {
+  return dv.getInt16(6);
+}
+%PrepareFunctionForOptimization(foo);
+
+assertThrows(() => foo(dv), RangeError);
+
+%OptimizeMaglevOnNextCall(foo);
+
+assertThrows(() => foo(dv), RangeError);

deps/v8/test/mjsunit/maglev/regress-466701290.js

@@ -0,0 +1,19 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+let ab = new ArrayBuffer(8);
+let view = new DataView(ab);
+
+function foo(dv) {
+  let len = dv.byteLength;
+  dv.getFloat64(0);
+  return len;
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(8, foo(view));
+%OptimizeMaglevOnNextCall(foo);
+assertEquals(8, foo(view));

deps/v8/tools/whitespace.txt

@@ -5,7 +5,7 @@ Try to write something funny. And please don't add trailing whitespace.
 A Smi balks into a war and says:
 "I'm so deoptimized today!"
 The doubles heard this and started to unbox.
-The Smi looked at them when a crazy v8-autoroll account showed up.....
+The Smi looked at them when a crazy v8-autoroll account showed up......
 The autoroller bought a round of Himbeerbrause. Suddenly...............
 The bartender starts to shake the bottles................................
 I can't add trailing whitespaces, so I'm adding this line................