diff --git a/common.gypi b/common.gypi index 3cda2a7e61d..e9e552df725 100644 --- a/common.gypi +++ b/common.gypi @@ -38,7 +38,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.49', + 'v8_embedder_string': '-node.50', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h index 8b49075955a..5df75d84d13 100644 --- a/deps/v8/src/wasm/function-body-decoder-impl.h +++ b/deps/v8/src/wasm/function-body-decoder-impl.h @@ -3483,7 +3483,11 @@ class WasmFullDecoder : public WasmDecoder { if (!VALIDATE(TypeCheckOneArmedIf(c))) return 0; } if (c->is_try_table()) { - current_catch_ = c->previous_catch; + // "Pop" the {current_catch_} index. We did not push it if the block has + // no handler, so also skip it here in this case. + if (c->catch_cases.size() > 0) { + current_catch_ = c->previous_catch; + } FallThrough(); // Temporarily set the reachability for the catch handlers, and restore // it before we actually exit the try block. diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js new file mode 100644 index 00000000000..23f49a64102 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js @@ -0,0 +1,21 @@ +// Copyright 2024 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --experimental-wasm-exnref + +d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js"); + +let builder = new WasmModuleBuilder(); +let tag = builder.addTag(kSig_v_v); +builder.addFunction("main", kSig_v_v) + .addBody([ + kExprTry, kWasmVoid, + kExprTryTable, kWasmVoid, 0, + kExprEnd, + kExprThrow, tag, + kExprCatchAll, + kExprEnd + ]).exportFunc(); +let instance = builder.instantiate(); +assertDoesNotThrow(instance.exports.main);