[wasm][exnref] Fix catchless try_table

thibaudmichaud · V8 LUCI CQ · commit 8e214ec3ec8c · 2024-10-09T11:49:43.000Z
If the try_table does not have a catch handler, we don't update the {current_catch_} index or set the {previous_catch} field of the block when we enter it. Therefore also skip the reverse operation when the block ends. R=clemensb@chromium.org Fixed: 372261626 Change-Id: Ib3a23e32f9d0ec153d6a00733d96b52cf040e8bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5920086 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#96481}
diff --git a/src/wasm/function-body-decoder-impl.h b/src/wasm/function-body-decoder-impl.h
@@ -3511,7 +3511,11 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         if (!VALIDATE(TypeCheckOneArmedIf(c))) return 0;
       }
       if (c->is_try_table()) {
-        current_catch_ = c->previous_catch;
+        // "Pop" the {current_catch_} index. We did not push it if the block has
+        // no handler, so also skip it here in this case.
+        if (c->catch_cases.size() > 0) {
+          current_catch_ = c->previous_catch;
+        }
         FallThrough();
         // Temporarily set the reachability for the catch handlers, and restore
         // it before we actually exit the try block.
diff --git a/test/mjsunit/regress/wasm/regress-372261626.js b/test/mjsunit/regress/wasm/regress-372261626.js
@@ -0,0 +1,21 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-exnref
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+let tag = builder.addTag(kSig_v_v);
+builder.addFunction("main", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmVoid,
+        kExprTryTable, kWasmVoid, 0,
+        kExprEnd,
+        kExprThrow, tag,
+      kExprCatchAll,
+      kExprEnd
+    ]).exportFunc();
+let instance = builder.instantiate();
+assertDoesNotThrow(instance.exports.main);
