[wasm][eh] Do not trap on special exception objects

Throwing an object that needs special property lookup currently traps
when we catch it in wasm. We should just return undefined to let the
caller know that this is not a wasm exception object.

Drive-by: use the named {caught_tag} register consistently.

R=clemensb@chromium.org

Bug: chromium:1188825
Change-Id: I8ebd4db756ac7ba04208ab43c7349c28b813fc49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2767519Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73497}

src/builtins/wasm.tq

@@ -412,15 +412,13 @@ transitioning builtin WasmGetOwnProperty(implicit context: Context)(
     try {
       TryHasOwnProperty(
           receiver, receiver.map, receiver.instanceType, uniqueName)
-          otherwise Found, NotFound, Bailout;
+          otherwise Found, NotFound, NotFound;
     } label Found {
       tail GetPropertyWithReceiver(
           receiver, uniqueName, receiver, SmiConstant(kReturnUndefined));
     }
   } label NotFound deferred {
     return Undefined;
-  } label Bailout deferred {
-    unreachable;
   }
 }
 

src/wasm/baseline/liftoff-compiler.cc

@@ -1134,7 +1134,7 @@ class LiftoffCompiler {
 
     DEBUG_CODE_COMMENT("compare tags");
     Label caught;
-    __ emit_cond_jump(kEqual, &caught, kI32, imm_tag, kReturnRegister0);
+    __ emit_cond_jump(kEqual, &caught, kI32, imm_tag, caught_tag.gp());
     // The tags don't match, merge the current state into the catch state and
     // jump to the next handler.
     __ MergeFullStackWith(block->try_info->catch_state, *__ cache_state());

test/mjsunit/regress/wasm/regress-1188825.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh
+load('test/mjsunit/wasm/wasm-module-builder.js')
+let obj = {};
+let proxy = new Proxy(obj, {});
+let builder = new WasmModuleBuilder();
+builder.addType(kSig_v_v);
+let imports = builder.addImport("m","f", kSig_v_v);
+let exception = builder.addException(kSig_v_v);
+builder.addFunction("foo", kSig_v_v)
+    .addBody([
+        kExprTry,
+        kWasmStmt,
+        kExprCallFunction, imports,
+        kExprCatch, exception,
+        kExprEnd]
+        ).exportFunc();
+let inst = builder.instantiate({
+  m: {
+    f: function () {
+      throw proxy;
+    }
+  }
+});
+assertThrows(inst.exports.foo);