deps: V8: cherry-pick 8e214ec3ec8c

thibaudmichaud · marco-ippolito · commit eae2c27a409f · 2026-05-11T14:43:13.000+02:00
Original commit message: [wasm][exnref] Fix catchless try_table If the try_table does not have a catch handler, we don't update the {current_catch_} index or set the {previous_catch} field of the block when we enter it. Therefore also skip the reverse operation when the block ends. R=clemensb@chromium.org Fixed: 372261626 Change-Id: Ib3a23e32f9d0ec153d6a00733d96b52cf040e8bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5920086 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#96481} Refs: v8/v8@8e214ec PR-URL: #62783 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/common.gypi b/common.gypi
@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.49',
+    'v8_embedder_string': '-node.50',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -3483,7 +3483,11 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         if (!VALIDATE(TypeCheckOneArmedIf(c))) return 0;
       }
       if (c->is_try_table()) {
-        current_catch_ = c->previous_catch;
+        // "Pop" the {current_catch_} index. We did not push it if the block has
+        // no handler, so also skip it here in this case.
+        if (c->catch_cases.size() > 0) {
+          current_catch_ = c->previous_catch;
+        }
         FallThrough();
         // Temporarily set the reachability for the catch handlers, and restore
         // it before we actually exit the try block.
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
@@ -0,0 +1,21 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-exnref
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+let tag = builder.addTag(kSig_v_v);
+builder.addFunction("main", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmVoid,
+        kExprTryTable, kWasmVoid, 0,
+        kExprEnd,
+        kExprThrow, tag,
+      kExprCatchAll,
+      kExprEnd
+    ]).exportFunc();
+let instance = builder.instantiate();
+assertDoesNotThrow(instance.exports.main);
