[maglev][arm64] Sign extend 16 bit value after reversing it

Fixed: v8:14197
Bug: v8:7700
Change-Id: I1d08c014a4ed033bc961a7391f84f368af09e3f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4699063
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89028}

src/maglev/arm64/maglev-assembler-arm64-inl.h

@@ -602,6 +602,7 @@ inline void MaglevAssembler::StoreField(MemOperand operand, Register value,
 inline void MaglevAssembler::ReverseByteOrder(Register value, int size) {
   if (size == 2) {
     Rev16(value, value);
+    Sxth(value, value);
   } else if (size == 4) {
     Rev32(value, value);
   } else {

test/mjsunit/maglev/regress-14197.js

@@ -0,0 +1,29 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --maglev
+
+let ab = new ArrayBuffer(4);
+let dv = new DataView(ab);
+
+const kA = 0x01_80;
+const kB = 0xFF_FF_FF_7F | 0;  // sign-extended 0xFF_7F
+
+// Explicitly write the big-endian int16 representations
+// of these values into the buffer:
+dv.setInt8(0, 0x01, false);
+dv.setInt8(1, 0x80, false);
+dv.setInt8(2, 0xFF, false);
+dv.setInt8(3, 0x7F, false);
+
+function f(dv, index) {
+  return dv.getInt16(index, false);  // big-endian read.
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(kA, f(dv, 0));
+assertEquals(kB, f(dv, 2));
+%OptimizeMaglevOnNextCall(f);
+assertEquals(kA, f(dv, 0));
+assertEquals(kB, f(dv, 2));