From 5a96a3530f02f495eb17e5effa877aade940e8a2 Mon Sep 17 00:00:00 2001
From: Victor Gomes <victorgomes@chromium.org>
Date: Thu, 04 Dec 2025 09:25:48 +0100
Subject: [PATCH] [maglev] Exception phis can be the hole

Fixed: 465730465
Change-Id: If1deb6975acd515c2209d24549bc7642535ecd5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7223977
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#104099}
---

diff --git a/src/maglev/maglev-ir.cc b/src/maglev/maglev-ir.cc
index ec83ede..fa8d01e 100644
--- a/src/maglev/maglev-ir.cc
+++ b/src/maglev/maglev-ir.cc
@@ -628,7 +628,7 @@
     return Tribool::kMaybe;
   }
   if (const Phi* phi = TryCast<Phi>()) {
-    if (!phi->is_loop_phi()) {
+    if (!phi->is_loop_phi() && !phi->is_exception_phi()) {
       bool can_be_the_hole = false;
       for (ConstInput input : phi->inputs()) {
         if (input.node()->IsTheHole() != Tribool::kFalse) {
diff --git a/test/mjsunit/maglev/regress-465730465.js b/test/mjsunit/maglev/regress-465730465.js
new file mode 100644
index 0000000..b2fbb29
--- /dev/null
+++ b/test/mjsunit/maglev/regress-465730465.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let glob;
+
+function empty() {}
+
+function foo(a) {
+  glob = 0;
+  var x;
+  switch (a) {
+    case 1:
+      let y = 1;
+    case 2:
+      try {
+        y = 2;
+        empty();
+        glob++;
+      } catch (e) {}
+      try {
+        x = y;
+      } catch (e) {
+        empty();
+        glob++;
+      }
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(1);
+assertEquals(1, glob);
+foo(2);
+assertEquals(1, glob);
+%OptimizeMaglevOnNextCall(foo);
+foo(2);
+assertEquals(1, glob);

diff --git a/test/mjsunit/maglev/regress-465730465.js b/test/mjsunit/maglev/regress-465730465.js
new file mode 100644
index 0000000..b2fbb29
--- /dev/null
+++ b/test/mjsunit/maglev/regress-465730465.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let glob;
+
+function empty() {}
+
+function foo(a) {
+  glob = 0;
+  var x;
+  switch (a) {
+    case 1:
+      let y = 1;
+    case 2:
+      try {
+        y = 2;
+        empty();
+        glob++;
+      } catch (e) {}
+      try {
+        x = y;
+      } catch (e) {
+        empty();
+        glob++;
+      }
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(1);
+assertEquals(1, glob);
+foo(2);
+assertEquals(1, glob);
+%OptimizeMaglevOnNextCall(foo);
+foo(2);
+assertEquals(1, glob);