[wasm] Support initial value for Table.grow

An initial value for Table.grow is supported by the core spec and does
not depend on a proposal, see [1].

[1] https://webassembly.github.io/spec/js-api/index.html#tables

R=thibaudm@chromium.org

Bug: v8:12227
Change-Id: Ia4f16adc76a0422b2211c069614929a1a70afa76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164979Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76905}

src/wasm/wasm-js.cc

@@ -1846,16 +1846,16 @@ void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  i::Handle<i::Object> init_value = i_isolate->factory()->null_value();
-  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
-  if (enabled_features.has_typed_funcref()) {
-    if (args.Length() >= 2 && !args[1]->IsUndefined()) {
-      init_value = Utils::OpenHandle(*args[1]);
-    }
+  i::Handle<i::Object> init_value;
+
+  if (args.Length() >= 2 && !args[1]->IsUndefined()) {
+    init_value = Utils::OpenHandle(*args[1]);
     if (!i::WasmTableObject::IsValidElement(i_isolate, receiver, init_value)) {
       thrower.TypeError("Argument 1 must be a valid type for the table");
       return;
     }
+  } else {
+    init_value = DefaultReferenceValue(i_isolate, receiver->type());
   }
 
   int old_size =

test/mjsunit/wasm/js-api.js

@@ -763,7 +763,7 @@ assertThrows(
     () => tbl.grow(-Infinity), TypeError, /must be convertible to a valid number/);
 assertEq(tbl.grow(0), 1);
 assertEq(tbl.length, 1);
-assertEq(tbl.grow(1, 4), 1);
+assertEq(tbl.grow(1, null, 4), 1);
 assertEq(tbl.length, 2);
 assertEq(tbl.length, 2);
 assertThrows(() => tbl.grow(1), Error, /failed to grow table by \d+/);

test/mjsunit/wasm/table.js

@@ -284,3 +284,18 @@ function assertTableIsValid(table, length) {
   table.grow({valueOf: () => {table.grow(2); return 1;}});
   assertEquals(3, table.length);
 })();
+
+(function TestGrowWithInit() {
+  function getDummy(val) {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction('dummy', kSig_i_v)
+        .addBody([kExprI32Const, val])
+        .exportAs('dummy');
+    return builder.instantiate().exports.dummy;
+  }
+  let table = new WebAssembly.Table({element: "anyfunc", initial: 1});
+  table.grow(5, getDummy(24));
+  for (let i = 1; i <= 5; ++i) {
+    assertEquals(24, table.get(i)());
+  }
+})();