[wasm] Leave Global constructor on error

In the WebAssembly.Global constructor we continued to execute even after
the JavaScript code in the descriptor.mutable getter threw an exception.
This caused a problem when the descriptor.value getter was executed even
though there was a scheduled exception.

R=jkummerow@chromium.org

Bug: chromium:1033948
Change-Id: Idac554175fe45ec677447b793db069eb6de543b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993283Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65669}

src/wasm/wasm-js.cc

@@ -1167,7 +1167,11 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
     if (maybe_value.ToLocal(&value)) {
       shared = value->BooleanValue(isolate) ? i::SharedFlag::kShared
                                             : i::SharedFlag::kNotShared;
+    } else {
+      DCHECK(i_isolate->has_scheduled_exception());
+      return;
     }
+
     // Throw TypeError if shared is true, and the descriptor has no "maximum"
     if (shared == i::SharedFlag::kShared && maximum == -1) {
       thrower.TypeError(
@@ -1259,6 +1263,9 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     v8::Local<v8::Value> value;
     if (maybe.ToLocal(&value)) {
       is_mutable = value->BooleanValue(isolate);
+    } else {
+      DCHECK(i_isolate->has_scheduled_exception());
+      return;
     }
   }
 

test/mjsunit/regress/wasm/regress-1033948.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const desc = {
+  get mutable() {
+    throw "foo";
+  },
+  get value() {
+    console.trace();
+  }
+};
+assertThrowsEquals(() => new WebAssembly.Global(desc), "foo");