deps: V8: cherry-pick b8f91e510e0f

Original commit message:

    [wasm][exnref] Update WA.JSTag semantics

    According to the last spec updates:
    - Passing WebAssembly.JSTag to the WebAssembly.Exception constructor is
      not allowed in JS,
    - Throwing an exception with the JSTag in wasm is allowed, but the
      exception should conceptually be "unwrapped" when it exits wasm, and
      JS should observe the raw externref. Instead, we simply throw the
      externref in this case, which has the same observable behavior and is
      consistent with how JSTag has been implemented so far.

    [email protected]

    Bug: 333067164
    Change-Id: I6f43df8d254dd7450137d99ff7cc9cbffb697663
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5454404
    Reviewed-by: Andreas Haas <[email protected]>
    Commit-Queue: Thibaud Michaud <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#93398}

Refs: v8/v8@b8f91e5

Author: thibaudmichaud

common.gypi

@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.44',
+    'v8_embedder_string': '-node.45',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/runtime/runtime-wasm.cc

@@ -354,12 +354,18 @@ RUNTIME_FUNCTION(Runtime_WasmThrow) {
   ClearThreadInWasmScope clear_wasm_flag(isolate);
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
-  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
+  Tagged<Context> context = GetNativeContextFromWasmInstanceOnStackTop(isolate);
+  isolate->set_context(context);
   Handle<WasmExceptionTag> tag(WasmExceptionTag::cast(args[0]), isolate);
   Handle<FixedArray> values(FixedArray::cast(args[1]), isolate);
-  Handle<WasmExceptionPackage> exception =
-      WasmExceptionPackage::New(isolate, tag, values);
-  return isolate->Throw(*exception);
+  auto js_tag = WasmTagObject::cast(context->wasm_js_tag());
+  if (*tag == js_tag->tag()) {
+    return isolate->Throw(values->get(0));
+  } else {
+    Handle<WasmExceptionPackage> exception =
+        WasmExceptionPackage::New(isolate, tag, values);
+    return isolate->Throw(*exception);
+  }
 }
 
 RUNTIME_FUNCTION(Runtime_WasmReThrow) {

deps/v8/src/wasm/wasm-js.cc

@@ -2001,6 +2001,11 @@ void WebAssemblyExceptionImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
       i::Handle<i::WasmTagObject>::cast(arg0);
   i::Handle<i::WasmExceptionTag> tag(
       i::WasmExceptionTag::cast(tag_object->tag()), i_isolate);
+  auto js_tag = i::WasmTagObject::cast(i_isolate->context()->wasm_js_tag());
+  if (*tag == js_tag->tag()) {
+    thrower.TypeError("Argument 0 cannot be WebAssembly.JSTag");
+    return;
+  }
   uint32_t size = GetEncodedSize(tag_object);
   i::Handle<i::WasmExceptionPackage> runtime_exception =
       i::WasmExceptionPackage::New(i_isolate, tag, size);

deps/v8/test/mjsunit/wasm/exceptions-api.js

@@ -295,11 +295,11 @@ function TestGetArgHelper(types_str, types, values) {
   }});
 
   let obj = {};
+  // Creating a WA.Exception with the JSTag explicitly is not allowed.
+  assertThrows(() => new WebAssembly.Exception(WebAssembly.JSTag, [obj]), TypeError);
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -316,11 +316,6 @@ function TestGetArgHelper(types_str, types, values) {
 
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();

deps/v8/test/mjsunit/wasm/exnref-api.js

@@ -41,11 +41,11 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   }});
 
   let obj = {};
+  // Creating a WA.Exception with the JSTag explicitly is not allowed.
+  assertThrows(() => new WebAssembly.Exception(WebAssembly.JSTag, [obj]), TypeError);
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -63,10 +63,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
   // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
@@ -107,8 +103,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch with implicit wrapping.
   assertSame(obj, instance.exports.test(obj));
-  // Catch with explicit wrapping.
-  assertSame(obj, instance.exports.test(new WebAssembly.Exception(WebAssembly.JSTag, [obj])));
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   let exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -125,11 +119,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch with explicit wrapping.
   assertSame(obj, instance.exports.test(new WebAssembly.Exception(not_js_tag, [obj])));
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
@@ -171,11 +160,6 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
 
   // Catch and rethrown with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
-  // Catch and rethrown with explicit wrapping.
-  // TODO: Should the exception get implicitly unwrapped when it
-  // is rethrown from wasm to JS, even though it was wrapped explicitly?
-  let exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with explicit wrapping.
   let not_js_tag = new WebAssembly.Tag({parameters:['externref']});
   exn = new WebAssembly.Exception(not_js_tag, [obj]);
@@ -193,11 +177,29 @@ d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");
   // Catch and rethrow with explicit wrapping -> not unwrapped in this case.
   exn = new WebAssembly.Exception(not_js_tag, [obj]);
   assertThrowsEquals(() => instance.exports.test(exn), exn);
-  // Don't catch with explicit wrapping.
-  exn = new WebAssembly.Exception(WebAssembly.JSTag, [obj]);
-  // TODO(thibaudm): Should the exception get implicitly unwrapped when it
-  // bubbles up from wasm to JS, even though it was wrapped explicitly?
-  assertThrowsEquals(() => instance.exports.test(exn), exn);
   // Don't catch with implicit wrapping.
   assertThrowsEquals(() => instance.exports.test(obj), obj);
 })();
+
+(function TestThrowJSTag() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let js_tag = builder.addImportedTag("", "tag", kSig_v_r);
+
+  // Throw a JS object with WebAssembly.JSTag and check that we can catch
+  // it as-is from JavaScript.
+  builder.addFunction("test", kSig_v_r)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprThrow, js_tag,
+    ])
+    .exportFunc();
+
+  let instance = builder.instantiate({"": {
+      tag: WebAssembly.JSTag,
+  }});
+
+  let obj = {};
+  assertThrowsEquals(() => instance.exports.test(obj), obj);
+  assertThrowsEquals(() => instance.exports.test(5), 5);
+})();