Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

10 files changed, 74 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
new file mode 100644
index 0000000000..4b0600c724
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
@@ -0,0 +1,9 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+// array.new_fixed has limit of 10_000 operands
+wasmFailValidateText(`(module
+  (type $a (array i32))
+  (func
+    array.new_fixed $a 10001
+  )
+)`, /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/load-mod.js b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
new file mode 100644
index 0000000000..cd972ceb65
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
@@ -0,0 +1,5 @@
+// Files for some of these tests are pre-generated and located in js/src/jit-test/lib/gen.
+// There you will also find the script to update these files.
+function loadMod(name) {
+  return decompressLZ4(os.file.readFile(libdir + "gen/" + name, "binary").buffer)
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
new file mode 100644
index 0000000000..489bf89cd4
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmValidateBinary(loadMod("wasm-gc-limits-r1M-t1.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
new file mode 100644
index 0000000000..40c020c4b5
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1M1-t1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
new file mode 100644
index 0000000000..ae60f38d57
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
@@ -0,0 +1,11 @@
+// |jit-test| --setpref=wasm_gc; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 10_000 struct fields
+wasmFailValidateBinary(loadMod("wasm-gc-limits-s10K1.wasm"), /too many/);
+{
+  let {makeLargeStructDefault, makeLargeStruct} = wasmEvalBinary(loadMod("wasm-gc-limits-s10K.wasm")).exports;
+  let largeStructDefault = makeLargeStructDefault();
+  let largeStruct = makeLargeStruct();
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
new file mode 100644
index 0000000000..2d70215ee9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
@@ -0,0 +1,13 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js; include: wasm-binary.js;
+
+// Limit of subtyping hierarchy 63 deep
+function moduleSubtypingDepth(depth) {
+  let types = [];
+  types.push({final: false, kind: FuncCode, args: [], ret: []});
+  for (let i = 1; i <= depth; i++) {
+    types.push({final: false, sub: i - 1, kind: FuncCode, args: [], ret: []});
+  }
+  return moduleWithSections([typeSection(types)]);
+}
+wasmValidateBinary(moduleSubtypingDepth(63));
+wasmFailValidateBinary(moduleSubtypingDepth(64), /too deep/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-1.js b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
new file mode 100644
index 0000000000..c097907e79
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r1-t1M.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-2.js b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
new file mode 100644
index 0000000000..5e81bdf6ab
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r2-t500K.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-3.js b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
new file mode 100644
index 0000000000..e9effa4bfa
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1-t1M1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-4.js b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
new file mode 100644
index 0000000000..dd413ed4e9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r2-t500K1.wasm"), /too many/);