deps: V8: cherry-pick b8f91e510e0f

thibaudmichaud · marco-ippolito · commit d0c24a28af20 · 2026-05-11T14:43:07.000+02:00
Original commit message: [wasm][exnref] Update WA.JSTag semantics According to the last spec updates: - Passing WebAssembly.JSTag to the WebAssembly.Exception constructor is not allowed in JS, - Throwing an exception with the JSTag in wasm is allowed, but the exception should conceptually be "unwrapped" when it exits wasm, and JS should observe the raw externref. Instead, we simply throw the externref in this case, which has the same observable behavior and is consistent with how JSTag has been implemented so far. R=ahaas@chromium.org Bug: 333067164 Change-Id: I6f43df8d254dd7450137d99ff7cc9cbffb697663 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5454404 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#93398} Refs: v8/v8@b8f91e5 PR-URL: #62783 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/common.gypi b/common.gypi
@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.44',
+    'v8_embedder_string': '-node.45',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
@@ -354,12 +354,18 @@ RUNTIME_FUNCTION(Runtime_WasmThrow) {
   ClearThreadInWasmScope clear_wasm_flag(isolate);
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
-  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
+  Tagged<Context> context = GetNativeContextFromWasmInstanceOnStackTop(isolate);
+  isolate->set_context(context);
   Handle<WasmExceptionTag> tag(WasmExceptionTag::cast(args[0]), isolate);
   Handle<FixedArray> values(FixedArray::cast(args[1]), isolate);
-  Handle<WasmExceptionPackage> exception =
-      WasmExceptionPackage::New(isolate, tag, values);
-  return isolate->Throw(*exception);
+  auto js_tag = WasmTagObject::cast(context->wasm_js_tag());
+  if (*tag == js_tag->tag()) {
+    return isolate->Throw(values->get(0));
+  } else {
+    Handle<WasmExceptionPackage> exception =
+        WasmExceptionPackage::New(isolate, tag, values);
+    return isolate->Throw(*exception);
+  }
 }
 
 RUNTIME_FUNCTION(Runtime_WasmReThrow) {
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
@@ -2001,6 +2001,11 @@ void WebAssemblyExceptionImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
       i::Handle<i::WasmTagObject>::cast(arg0);
   i::Handle<i::WasmExceptionTag> tag(
       i::WasmExceptionTag::cast(tag_object->tag()), i_isolate);
+  auto js_tag = i::WasmTagObject::cast(i_isolate->context()->wasm_js_tag());
+  if (*tag == js_tag->tag()) {
+    thrower.TypeError("Argument 0 cannot be WebAssembly.JSTag");
+    return;
+  }
   uint32_t size = GetEncodedSize(tag_object);
   i::Handle<i::WasmExceptionPackage> runtime_exception =
       i::WasmExceptionPackage::New(i_isolate, tag, size);
diff --git a/deps/v8/test/mjsunit/wasm/exceptions-api.js b/deps/v8/test/mjsunit/wasm/exceptions-api.js
@@ -295,11 +295,11 @@ function TestGetArgHelper(types_str, types, values) {
   }});
 
   let obj = {};
+  // Creating a WA.Exception with the JSTag explicitly is not allowed.
+  assertThrows(() => new WebAssembly.Exception(WebAssembly.JSTag, [obj]), TypeError);
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -316,11 +316,6 @@ function TestGetArgHelper(types_str, types, values) {
 
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
diff --git a/deps/v8/test/mjsunit/wasm/exnref-api.js b/deps/v8/test/mjsunit/wasm/exnref-api.js
@@ -41,11 +41,11 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   }});
 
   let obj = {};
+  // Creating a WA.Exception with the JSTag explicitly is not allowed.
+  assertThrows(() => new WebAssembly.Exception(WebAssembly.JSTag, [obj]), TypeError);
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -63,10 +63,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
   // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
@@ -107,8 +103,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -125,11 +119,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
@@ -171,11 +160,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch and rethrown with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
-  // Catch and rethrown with explicit wrapping.
-  // TODO: Should the exception get implicitly unwrapped when it
-  // is rethrown from wasm to JS, even though it was wrapped explicitly?
-  let exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -193,11 +177,29 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   // Catch and rethrow with explicit wrapping -> not unwrapped in this case.
   exn = new WebAssembly.Exception(not_js_tag, [obj]);
   assertThrowsEquals(() => instance.exports.test(exn), exn);
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
+
+(function TestThrowJSTag() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let js_tag = builder.addImportedTag("", "tag", kSig_v_r);
+
+  // Throw a JS object with WebAssembly.JSTag and check that we can catch
+  // it as-is from JavaScript.
+  builder.addFunction("test", kSig_v_r)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprThrow, js_tag,
+    ])
+    .exportFunc();
+
+  let instance = builder.instantiate({"": {
+      tag: WebAssembly.JSTag,
+  }});
+
+  let obj = {};
+  assertThrowsEquals(() => instance.exports.test(obj), obj);
+  assertThrowsEquals(() => instance.exports.test(5), 5);
+})();
