[wasm] Fix decoding of try-table block type

R=manoskouk@chromium.org

Fixed: v8:14689
Change-Id: I209a5ede968bdfea25b5ce9964d7b938247de30a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401863
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93096}
diff --git a/src/wasm/function-body-decoder-impl.h b/src/wasm/function-body-decoder-impl.h
index 2f16fcf..4eff60d 100644
--- a/src/wasm/function-body-decoder-impl.h
+++ b/src/wasm/function-body-decoder-impl.h
@@ -3301,7 +3301,7 @@
       ++i;
     }
     CALL_INTERFACE_IF_OK_AND_REACHABLE(TryTable, try_block);
-    return 2 + try_table_iterator.length();
+    return 1 + block_imm.length + try_table_iterator.length();
   }
 
   DECODE(ThrowRef) {
diff --git a/test/mjsunit/regress/wasm/regress-14689.js b/test/mjsunit/regress/wasm/regress-14689.js
new file mode 100644
index 0000000..00a9ed4
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-14689.js
@@ -0,0 +1,25 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-exnref
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function Regress14689() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let struct = builder.addStruct([]);
+  let except = builder.addTag(kSig_v_v);
+  builder.addFunction("main", kSig_v_v)
+      .addBody([
+        kExprTryTable, kWasmRef, struct, 1,
+        kCatchNoRef, except, 0,
+        kExprBr, 1,
+        kExprEnd,
+        kExprUnreachable,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertDoesNotThrow(instance.exports.main);
+})();