From f30dfeeff5a340ec620700ac9c7d178064a60faa Mon Sep 17 00:00:00 2001
From: Derek Schuff <dschuff@chromium.org>
Date: Fri, 14 Jun 2024 11:56:43 -0700
Subject: [PATCH] Throw TypeError if new Exception or getArg would expose v128
 to JS (#309)

Fixes #308
Fixes #295
---
 document/js-api/index.bs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/document/js-api/index.bs b/document/js-api/index.bs
index d3464d92..6f96f240 100644
--- a/document/js-api/index.bs
+++ b/document/js-api/index.bs
@@ -1322,6 +1322,8 @@ constructor steps are:
     1. Throw a {{TypeError}}.
 1. Let |wasmPayload| be « ».
 1. [=list/iterate|For each=] |value| and |resultType| of |payload| and |types|, paired linearly,
+    1. If |resultType| is [=v128=] or [=exnref=],
+        1. Throw a {{TypeError}}.
     1. [=list/Append=] [=?=] [=ToWebAssemblyValue=](|value|, |resultType|) to |wasmPayload|.
 1. Let (|store|, |exceptionAddr|) be [=exn_alloc=](|store|, |exceptionTag|.\[[Address]], |wasmPayload|)
 1. Set the [=surrounding agent=]'s [=associated store=] to |store|.
@@ -1341,6 +1343,9 @@ The <dfn method for="Exception">getArg(|index|)</dfn> method steps are:
 1. Assert: |tagaddr| is equal to **this**.\[[Type]].
 1. If |index| ≥ |payload|'s [=list/size=],
     1. Throw a {{RangeError}}.
+1. Let [|types|] → [] be [=tag_type=](|store|, |tagaddr|).
+1. If |types|[|index|] is [=v128=] or [=exnref=],
+    1. Throw a {{TypeError}}.
 1. Return [=ToJSValue=](|payload|[|index|]).
 
 </div>