deps: patch V8 to 14.2.231.17

Refs: v8/v8@14.2.231.16...14.2.231.17
PR-URL: #60647
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Author: nodejs-github-bot

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #defineV8_MAJOR_VERSION 14
 #defineV8_MINOR_VERSION 2
 #defineV8_BUILD_NUMBER 231
-#defineV8_PATCH_LEVEL16
+#defineV8_PATCH_LEVEL17
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/maglev/maglev-graph-builder.cc

@@ -4531,9 +4531,20 @@ ValueNode* MaglevGraphBuilder::ConvertForField(ValueNode* value,
  AllocationType allocation_type) {
  switch (desc.type) {
  case vobj::FieldType::kTagged: {
- if (value->Is<Float64Constant>() &&
- !NodeTypeIs(GetType(value), NodeType::kSmi)) {
- // Note that NodeType::kSmi MUST go through GetTaggedValue for proper
+ // Subtle: we don't use `NodeTypeIs(...)` since the predicate must NOT
+ // be true for NodeType::kNone.
+ // TODO(jgruber): NodeType::kNone should never reach here.
+ if (GetType(value) == NodeType::kSmi) {
+ // TODO(jgruber): This is needed because HoleyFloat64ToTagged does not
+ // canonicalize smis by default in GetTaggedValue. We rely on
+ // canonicalization though in TryReduceConstructArrayConstructor.
+ // We should make this more robust.
+ MaybeReduceResult res = GetSmiValue(value);
+ CHECK(res.IsDoneWithValue());
+ return res.value();
+ }
+ if (value->Is<Float64Constant>()) {
+ // Note that NodeType::kSmi MUST go through GetSmiValue for proper
  // canonicalization. If we see a Float64Constant with type kSmi, it has
  // passed BuildCheckSmi, i.e. the runtime value is guaranteed to be
  // convertible to smi (we would have deoptimized otherwise).

deps/v8/test/mjsunit/regress/regress-454485895.js

@@ -0,0 +1,25 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+// HOLEY_DOUBLE_ELEMENTS.
+constarr=[1,,,,,1.1];
+
+functionopt_me(){
+for(leti=0;i<5;i++){
+constele=arr[i];
+constarr2=Array(ele,i);
+functioninner(){
+arr2.join();
+arr.__proto__=ele;
+}
+inner();
+}
+}
+
+%PrepareFunctionForOptimization(opt_me);
+opt_me();
+%OptimizeMaglevOnNextCall(opt_me);
+opt_me();

deps/v8/test/mjsunit/regress/regress-454861480.js

@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+functionf0(){
+try{
+([f0,f0]).forEach(undefined);
+classC4{
+[undefined];
+}
+}catch(e5){
+}
+returnf0;
+}
+constv6=%PrepareFunctionForOptimization(f0);
+f0();
+constv8=%OptimizeMaglevOnNextCall(f0);
+f0();

deps/v8/test/mjsunit/regress/regress-454943951.js

@@ -0,0 +1,19 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function*__f_0(__v_1){
+for(let__v_2=0;__v_2<__v_1;__v_2++){
+for(let__v_3=0;__v_3<__v_1;__v_3++){
+Math.acos(false);
+yield__v_2*10+__v_3;
+}
+}
+}
+%PrepareFunctionForOptimization(__f_0);
+let__v_0=__f_0(4);
+__v_0.next().value;
+%OptimizeFunctionOnNextCall(__f_0);
+__v_0=__f_0();