deps: V8: cherry-pick b96e40d5ac85

Original commit message:

    [wasm][js-api] Fix exception handling in Exception

    Calling `Get` on the third argument can throw. If so, return
    immediately.

    [email protected]

    Fixed: 372993873
    Change-Id: I70ec0d0421833a60151f6bcdc9c386f6ad864256
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5937803
    Reviewed-by: Thibaud Michaud <[email protected]>
    Commit-Queue: Clemens Backes <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#96627}

Refs: v8/v8@b96e40d

Author: backes

deps/v8/src/wasm/wasm-js.cc

@@ -2046,11 +2046,12 @@ void WebAssemblyExceptionImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
     Local<Context> context = isolate->GetCurrentContext();
     Local<Object> trace_stack_obj = Local<Object>::Cast(info[2]);
     Local<String> trace_stack_key = v8_str(isolate, "traceStack");
-    v8::MaybeLocal<v8::Value> maybe_trace_stack =
-        trace_stack_obj->Get(context, trace_stack_key);
     v8::Local<Value> trace_stack_value;
-    if (maybe_trace_stack.ToLocal(&trace_stack_value) &&
-        trace_stack_value->BooleanValue(isolate)) {
+    if (!trace_stack_obj->Get(context, trace_stack_key)
+             .ToLocal(&trace_stack_value)) {
+      return;
+    }
+    if (trace_stack_value->BooleanValue(isolate)) {
       auto caller = Utils::OpenHandle(*info.NewTarget());
 
       i::Handle<i::Object> capture_result;

deps/v8/test/mjsunit/regress/wasm/regress-372993873.js

@@ -0,0 +1,12 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let tag = new WebAssembly.Tag({'parameters': []});
+let proxy = new Proxy({}, {
+  'get': () => {
+    throw new Error('boom')
+  }
+});
+
+assertThrows(() => new WebAssembly.Exception(tag, [], proxy), Error, 'boom');