From eae2c27a409fc3cc6c11bbfbfb1ce7bd17701090 Mon Sep 17 00:00:00 2001
From: Thibaud Michaud <thibaudm@chromium.org>
Date: Wed, 9 Oct 2024 13:19:52 +0200
Subject: [PATCH] deps: V8: cherry-pick 8e214ec3ec8c

Original commit message:

    [wasm][exnref] Fix catchless try_table

    If the try_table does not have a catch handler, we don't update the
    {current_catch_} index or set the {previous_catch} field of the block
    when we enter it. Therefore also skip the reverse operation when the
    block ends.

    R=clemensb@chromium.org

    Fixed: 372261626
    Change-Id: Ib3a23e32f9d0ec153d6a00733d96b52cf040e8bd
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5920086
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96481}

Refs: https://github.com/v8/v8/commit/8e214ec3ec8cdbdb7f34433a48a52420dee19ba6
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 common.gypi                                   |  2 +-
 deps/v8/src/wasm/function-body-decoder-impl.h |  6 +++++-
 .../mjsunit/regress/wasm/regress-372261626.js | 21 +++++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-372261626.js

diff --git a/common.gypi b/common.gypi
index 3cda2a7e61d..e9e552df725 100644
--- a/common.gypi
+++ b/common.gypi
@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.49',
+    'v8_embedder_string': '-node.50',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index 8b49075955a..5df75d84d13 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -3483,7 +3483,11 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         if (!VALIDATE(TypeCheckOneArmedIf(c))) return 0;
       }
       if (c->is_try_table()) {
-        current_catch_ = c->previous_catch;
+        // "Pop" the {current_catch_} index. We did not push it if the block has
+        // no handler, so also skip it here in this case.
+        if (c->catch_cases.size() > 0) {
+          current_catch_ = c->previous_catch;
+        }
         FallThrough();
         // Temporarily set the reachability for the catch handlers, and restore
         // it before we actually exit the try block.
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
new file mode 100644
index 00000000000..23f49a64102
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
@@ -0,0 +1,21 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-exnref
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+let tag = builder.addTag(kSig_v_v);
+builder.addFunction("main", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmVoid,
+        kExprTryTable, kWasmVoid, 0,
+        kExprEnd,
+        kExprThrow, tag,
+      kExprCatchAll,
+      kExprEnd
+    ]).exportFunc();
+let instance = builder.instantiate();
+assertDoesNotThrow(instance.exports.main);