Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

25 files changed, 313 insertions, 125 deletions

diff --git a/js/src/jit-test/tests/wasm/gc/arrays.js b/js/src/jit-test/tests/wasm/gc/arrays.js
index b3f03151bb..cb61bb1b07 100644
--- a/js/src/jit-test/tests/wasm/gc/arrays.js
+++ b/js/src/jit-test/tests/wasm/gc/arrays.js
@@ -604,6 +604,51 @@ assertErrorMessage(() => wasmEvalText(`(module
     },WebAssembly.RuntimeError, /index out of bounds/);
 }
 
+// run: zero-length copies are allowed
+{
+  let { newData } = wasmEvalText(`(module
+      (type $a (array i8))
+      (data $d "1337")
+      (func (export "newData") (result eqref)
+              (; offset=0 into data ;) i32.const 0
+              (; size=0 into data ;) i32.const 0
+              array.new_data $a $d
+      )
+      )`).exports;
+  let arr = newData();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: a zero-length copy from the end is allowed
+{
+  let { newData } = wasmEvalText(`(module
+      (type $a (array i8))
+      (data $d "1337")
+      (func (export "newData") (result eqref)
+              (; offset=4 into data ;) i32.const 4
+              (; size=0 into data ;) i32.const 0
+              array.new_data $a $d
+      )
+      )`).exports;
+  let arr = newData();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: even empty data segments are allowed
+{
+  let { newData } = wasmEvalText(`(module
+      (type $a (array i8))
+      (data $d "")
+      (func (export "newData") (result eqref)
+              (; offset=0 into data ;) i32.const 0
+              (; size=0 into data ;) i32.const 0
+              array.new_data $a $d
+      )
+      )`).exports;
+  let arr = newData();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
 // run: resulting array is as expected
 {
     let { newData } = wasmEvalText(`(module
@@ -802,6 +847,59 @@ assertErrorMessage(() => wasmEvalText(`(module
     },WebAssembly.RuntimeError, /index out of bounds/);
 }
 
+// run: zero-length copies are allowed
+{
+  let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+      (type $a (array funcref))
+      (elem $e func $f1 $f2 $f3 $f4)
+      (func $f1 (export "f1"))
+      (func $f2 (export "f2"))
+      (func $f3 (export "f3"))
+      (func $f4 (export "f4"))
+      (func (export "newElem") (result eqref)
+              (; offset=0 into elem ;) i32.const 0
+              (; size=0 into elem ;) i32.const 0
+              array.new_elem $a $e
+      )
+      )`).exports;
+  let arr = newElem();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: a zero-length copy from the end is allowed
+{
+  let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+      (type $a (array funcref))
+      (elem $e func $f1 $f2 $f3 $f4)
+      (func $f1 (export "f1"))
+      (func $f2 (export "f2"))
+      (func $f3 (export "f3"))
+      (func $f4 (export "f4"))
+      (func (export "newElem") (result eqref)
+              (; offset=4 into elem ;) i32.const 4
+              (; size=0 into elem ;) i32.const 0
+              array.new_elem $a $e
+      )
+      )`).exports;
+  let arr = newElem();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: even empty elem segments are allowed
+{
+    let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+        (type $a (array funcref))
+        (elem $e func)
+        (func (export "newElem") (result eqref)
+                (; offset=0 into elem ;) i32.const 0
+                (; size=0 into elem ;) i32.const 0
+                array.new_elem $a $e
+        )
+        )`).exports;
+    let arr = newElem();
+    assertEq(wasmGcArrayLength(arr), 0);
+}
+
 // run: resulting array is as expected
 {
     let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
@@ -1130,6 +1228,29 @@ assertErrorMessage(() => wasmEvalText(`(module
   },WebAssembly.RuntimeError, /index out of bounds/);
 }
 
+// run: zeroes everywhere
+{
+  let { initData } = wasmEvalText(`(module
+    (type $a (array (mut i8)))
+    (data $d "")
+    (func (export "initData") (result eqref)
+      (local $arr (ref $a))
+      (local.set $arr (array.new_default $a (i32.const 0)))
+
+      (; array to init ;)       local.get $arr
+      (; offset=0 into array ;) i32.const 0
+      (; offset=0 into data ;)  i32.const 0
+      (; size=0 elements ;)     i32.const 0
+      array.init_data $a $d
+
+      local.get $arr
+    )
+    (func data.drop 0) ;; force write of data count section, see https://github.com/bytecodealliance/wasm-tools/pull/1194
+  )`).exports;
+  let arr = initData();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
 // run: resulting array is as expected
 {
   let { initData } = wasmEvalText(`(module
@@ -1488,6 +1609,28 @@ assertErrorMessage(() => wasmEvalText(`(module
   },WebAssembly.RuntimeError, /index out of bounds/);
 }
 
+// run: zeroes everywhere
+{
+  let { initElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+    (type $a (array (mut funcref)))
+    (elem $e func)
+    (func (export "initElem") (result eqref)
+      (local $arr (ref $a))
+      (local.set $arr (array.new_default $a (i32.const 0)))
+
+      (; array to init ;)       local.get $arr
+      (; offset=0 into array ;) i32.const 0
+      (; offset=0 into elem ;)  i32.const 0
+      (; size=0 into elem ;)    i32.const 0
+      array.init_elem $a $e
+
+      local.get $arr
+    )
+  )`).exports;
+  let arr = initElem();
+  assertEq(wasmGcArrayLength(arr), 0);
+}
+
 // run: resulting array is as expected
 {
   let { initElem, f1, f2, f3, f4 } = wasmEvalText(`(module
diff --git a/js/src/jit-test/tests/wasm/gc/binary.js b/js/src/jit-test/tests/wasm/gc/binary.js
index 1ef4a586a8..e16af2bfbf 100644
--- a/js/src/jit-test/tests/wasm/gc/binary.js
+++ b/js/src/jit-test/tests/wasm/gc/binary.js
@@ -2,14 +2,16 @@
 
 load(libdir + "wasm-binary.js");
 
-const v2vSig = {args:[], ret:VoidCode};
-const v2vSigSection = sigSection([v2vSig]);
-
 function checkInvalid(body, errorMessage) {
     assertErrorMessage(() => new WebAssembly.Module(
-        moduleWithSections([v2vSigSection, declSection([0]), bodySection([body])])),
-                       WebAssembly.CompileError,
-                       errorMessage);
+        moduleWithSections([
+            typeSection([
+                { kind: FuncCode, args: [], ret: [] },
+            ]),
+            declSection([0]),
+            bodySection([body]),
+        ])
+    ), WebAssembly.CompileError, errorMessage);
 }
 
 const invalidRefBlockType = funcBody({locals:[], body:[
@@ -23,7 +25,7 @@ checkInvalid(invalidRefBlockType, /heap type/);
 const invalidTooBigRefType = funcBody({locals:[], body:[
     BlockCode,
     OptRefCode,
-    varU32(1000000),
+    ...varU32(1000000),
     EndCode,
 ]});
 checkInvalid(invalidTooBigRefType, /heap type/);
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1843295.js b/js/src/jit-test/tests/wasm/gc/bug-1843295.js
index 19a32263f6..765a9000a1 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1843295.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1843295.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled(); --wasm-test-serialization
+// |jit-test| skip-if: !wasmGcEnabled(); --setpref=wasm_test_serialization=true
 
 wasmEvalText(`(module
   (type (sub (array (mut i32))))
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1845436.js b/js/src/jit-test/tests/wasm/gc/bug-1845436.js
index a79c22d9a1..6ea8070f4d 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1845436.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1845436.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled(); --wasm-test-serialization
+// |jit-test| skip-if: !wasmGcEnabled(); --setpref=wasm_test_serialization=true
 
 // Test that serialization doesn't create a forward reference to the third
 // struct when serializing the reference to the first struct, which is
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1854007.js b/js/src/jit-test/tests/wasm/gc/bug-1854007.js
index c9d6b25369..d3e5afa9cd 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1854007.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1854007.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--wasm-test-serialization; skip-if: !wasmGcEnabled()
+// |jit-test| test-also=--setpref=wasm_test_serialization=true; skip-if: !wasmGcEnabled()
 
 let {run} = wasmEvalText(`(module
   (rec (type $$t1 (func (result (ref null $$t1)))))
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1879096.js b/js/src/jit-test/tests/wasm/gc/bug-1879096.js
new file mode 100644
index 0000000000..e71d2bac27
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/bug-1879096.js
@@ -0,0 +1,65 @@
+// |jit-test| test-also=--setpref=wasm_test_serialization; skip-if: !wasmGcEnabled()
+
+// Conditional branch instructions need to rewrite their stack types according
+// to the destination label types. This loses information but is mandated by
+// the spec.
+
+// br_if
+wasmFailValidateText(`(module
+  (func (result anyref)
+    ref.null array      ;; stack: [arrayref]
+    ref.null struct     ;; stack: [arrayref structref]
+    i32.const 0         ;; stack: [arrayref structref i32]
+    br_if 0             ;; stack: [arrayref anyref]
+    ref.eq              ;; should fail (anyref is not eq)
+    unreachable
+  )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_null
+wasmFailValidateText(`(module
+  (func (param externref) (result anyref)
+    ref.null array      ;; stack: [arrayref]
+    local.get 0         ;; stack: [arrayref externref]
+    br_on_null 0        ;; stack: [anyref (ref extern)]
+    drop                ;; stack: [anyref]
+    array.len           ;; should fail
+    unreachable
+  )
+)`, /type mismatch: expression has type anyref but expected arrayref/);
+
+// br_on_non_null
+wasmFailValidateText(`(module
+  (func (param externref) (result anyref (ref extern))
+    ref.null array      ;; stack: [arrayref]
+    ref.null struct     ;; stack: [arrayref structref]
+    local.get 0         ;; stack: [arrayref structref externref]
+    br_on_non_null 0    ;; stack: [arrayref anyref]
+    ref.eq              ;; should fail (anyref is not eq)
+    unreachable
+  )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_cast
+wasmFailValidateText(`(module
+  (type $s (struct))
+  (func (result anyref (ref $s))
+    ref.null array                    ;; stack: [arrayref]
+    ref.null struct                   ;; stack: [arrayref structref]
+    br_on_cast 0 structref (ref $s)   ;; stack: [anyref structref]
+    ref.eq                            ;; should fail (anyref is not eq)
+    unreachable
+  )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_cast_fail
+wasmFailValidateText(`(module
+  (type $s (struct))
+  (func (result anyref anyref)
+    ref.null array                        ;; stack: [arrayref]
+    ref.null struct                       ;; stack: [arrayref structref]
+    br_on_cast_fail 0 structref (ref $s)  ;; stack: [anyref (ref $s)]
+    ref.eq                                ;; should fail (anyref is not eq)
+    unreachable
+  )
+)`, /type mismatch: expression has type anyref but expected eqref/);
diff --git a/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js b/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
index 4301621a8c..d83f2ed624 100644
--- a/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
+++ b/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--wasm-tail-calls; skip-if: !wasmGcEnabled()
+// |jit-test| test-also=--setpref=wasm_tail_calls=true; skip-if: !wasmGcEnabled()
 
 // Test that call_indirect will respect subtyping by defining a bunch of types
 // and checking every combination of (expected, actual) type.
diff --git a/js/src/jit-test/tests/wasm/gc/directives.txt b/js/src/jit-test/tests/wasm/gc/directives.txt
index e6d978cc44..293724e57a 100644
--- a/js/src/jit-test/tests/wasm/gc/directives.txt
+++ b/js/src/jit-test/tests/wasm/gc/directives.txt
@@ -1 +1 @@
-|jit-test| --wasm-gc; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js
+|jit-test| test-also=--setpref=wasm_gc=true; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js
diff --git a/js/src/jit-test/tests/wasm/gc/disabled.js b/js/src/jit-test/tests/wasm/gc/disabled.js
index 791c6ff25e..206d32b1c4 100644
--- a/js/src/jit-test/tests/wasm/gc/disabled.js
+++ b/js/src/jit-test/tests/wasm/gc/disabled.js
@@ -2,7 +2,7 @@
 
 const { CompileError, validate } = WebAssembly;
 
-const UNRECOGNIZED_OPCODE_OR_BAD_TYPE = /unrecognized opcode|(Structure|reference|gc) types not enabled|invalid heap type|invalid inline block type|bad type|\(ref T\) types not enabled|Invalid type|invalid function type/;
+const UNRECOGNIZED_OPCODE_OR_BAD_TYPE = /unrecognized opcode|gc not enabled|invalid heap type|invalid inline block type|bad type|Invalid type|invalid function type/;
 
 let simpleTests = [
     "(module (func (drop (ref.null eq))))",
diff --git a/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js b/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
index 5a4951c585..2c67bbce8b 100644
--- a/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
+++ b/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
@@ -10,7 +10,7 @@
 // actually testing something here.
 //
 // Some logging with printf confirms that refmod is baseline-compiled and
-// nonrefmod is ion-compiled at present, with --wasm-gc enabled.
+// nonrefmod is ion-compiled at present, with --setpref=wasm_gc=true enabled.
 
 var refmod = new WebAssembly.Module(wasmTextToBinary(
     `(module
diff --git a/js/src/jit-test/tests/wasm/gc/limits.js b/js/src/jit-test/tests/wasm/gc/limits.js
deleted file mode 100644
index e6f21b5d6b..0000000000
--- a/js/src/jit-test/tests/wasm/gc/limits.js
+++ /dev/null
@@ -1,69 +0,0 @@
-// |jit-test| skip-if: !wasmGcEnabled() || getBuildConfiguration("tsan")
-
-// This test has a timeout on TSAN configurations due to the large
-// allocations.
-
-// Limit of 1 million recursion groups
-wasmValidateText(`(module
-    ${`(rec (type (func)))`.repeat(1_000_000)}
-  )`);
-wasmFailValidateText(`(module
-    ${`(rec (type (func)))`.repeat(1_000_001)}
-  )`, /too many/);
-
-// Limit of 1 million types (across all recursion groups)
-wasmValidateText(`(module
-    (rec ${`(type (func))`.repeat(1_000_000)})
-  )`);
-wasmValidateText(`(module
-    (rec ${`(type (func))`.repeat(500_000)})
-    (rec ${`(type (func))`.repeat(500_000)})
-  )`);
-wasmFailValidateText(`(module
-    (rec ${`(type (func))`.repeat(1_000_001)})
-  )`, /too many/);
-wasmFailValidateText(`(module
-    (rec ${`(type (func))`.repeat(500_000)})
-    (rec ${`(type (func))`.repeat(500_001)})
-  )`, /too many/);
-
-// Limit of subtyping hierarchy 63 deep
-function testSubtypingModule(depth) {
-  let types = '(type (sub (func)))';
-  for (let i = 1; i <= depth; i++) {
-    types += `(type (sub ${i - 1} (func)))`;
-  }
-  return `(module
-      ${types}
-    )`;
-}
-wasmValidateText(testSubtypingModule(63));
-wasmFailValidateText(testSubtypingModule(64), /too deep/);
-
-// Limit of 10_000 struct fields
-wasmFailValidateText(`(module
-  (type (struct ${'(field i64)'.repeat(10_001)}))
-)`, /too many/);
-
-{
-  let {makeLargeStructDefault, makeLargeStruct} = wasmEvalText(`(module
-    (type $s (struct ${'(field i64)'.repeat(10_000)}))
-    (func (export "makeLargeStructDefault") (result anyref)
-      struct.new_default $s
-    )
-    (func (export "makeLargeStruct") (result anyref)
-      ${'i64.const 0 '.repeat(10_000)}
-      struct.new $s
-    )
-  )`).exports;
-  let largeStructDefault = makeLargeStructDefault();
-  let largeStruct = makeLargeStruct();
-}
-
-// array.new_fixed has limit of 10_000 operands
-wasmFailValidateText(`(module
-  (type $a (array i32))
-  (func
-    array.new_fixed $a 10001
-  )
-)`, /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
new file mode 100644
index 0000000000..4b0600c724
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
@@ -0,0 +1,9 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+// array.new_fixed has limit of 10_000 operands
+wasmFailValidateText(`(module
+  (type $a (array i32))
+  (func
+    array.new_fixed $a 10001
+  )
+)`, /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/load-mod.js b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
new file mode 100644
index 0000000000..cd972ceb65
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
@@ -0,0 +1,5 @@
+// Files for some of these tests are pre-generated and located in js/src/jit-test/lib/gen.
+// There you will also find the script to update these files.
+function loadMod(name) {
+  return decompressLZ4(os.file.readFile(libdir + "gen/" + name, "binary").buffer)
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
new file mode 100644
index 0000000000..489bf89cd4
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmValidateBinary(loadMod("wasm-gc-limits-r1M-t1.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
new file mode 100644
index 0000000000..40c020c4b5
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1M1-t1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
new file mode 100644
index 0000000000..ae60f38d57
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
@@ -0,0 +1,11 @@
+// |jit-test| --setpref=wasm_gc; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 10_000 struct fields
+wasmFailValidateBinary(loadMod("wasm-gc-limits-s10K1.wasm"), /too many/);
+{
+  let {makeLargeStructDefault, makeLargeStruct} = wasmEvalBinary(loadMod("wasm-gc-limits-s10K.wasm")).exports;
+  let largeStructDefault = makeLargeStructDefault();
+  let largeStruct = makeLargeStruct();
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
new file mode 100644
index 0000000000..2d70215ee9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
@@ -0,0 +1,13 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js; include: wasm-binary.js;
+
+// Limit of subtyping hierarchy 63 deep
+function moduleSubtypingDepth(depth) {
+  let types = [];
+  types.push({final: false, kind: FuncCode, args: [], ret: []});
+  for (let i = 1; i <= depth; i++) {
+    types.push({final: false, sub: i - 1, kind: FuncCode, args: [], ret: []});
+  }
+  return moduleWithSections([typeSection(types)]);
+}
+wasmValidateBinary(moduleSubtypingDepth(63));
+wasmFailValidateBinary(moduleSubtypingDepth(64), /too deep/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-1.js b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
new file mode 100644
index 0000000000..c097907e79
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r1-t1M.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-2.js b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
new file mode 100644
index 0000000000..5e81bdf6ab
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r2-t500K.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-3.js b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
new file mode 100644
index 0000000000..e9effa4bfa
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1-t1M1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-4.js b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
new file mode 100644
index 0000000000..dd413ed4e9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r2-t500K1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/ref.js b/js/src/jit-test/tests/wasm/gc/ref.js
index a55b0c8f02..2bf76daf52 100644
--- a/js/src/jit-test/tests/wasm/gc/ref.js
+++ b/js/src/jit-test/tests/wasm/gc/ref.js
@@ -173,7 +173,7 @@ assertErrorMessage(() => wasmEvalText(`
 `),
 WebAssembly.CompileError, /expression has type \(ref null.*\) but expected \(ref null.*\)/);
 
-if (!wasmFunctionReferencesEnabled()) {
+if (!wasmGcEnabled()) {
   // Ref type can't reference a function type
 
   assertErrorMessage(() => wasmEvalText(`
diff --git a/js/src/jit-test/tests/wasm/gc/regress-1754701.js b/js/src/jit-test/tests/wasm/gc/regress-1754701.js
index 656aa5d625..1a2307fa87 100644
--- a/js/src/jit-test/tests/wasm/gc/regress-1754701.js
+++ b/js/src/jit-test/tests/wasm/gc/regress-1754701.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled() || !('oomTest' in this)
+// |jit-test| skip-if: !wasmGcEnabled()
 
 let { testArray, testStructInline, testStructOutline } = wasmEvalText(`
   (module
diff --git a/js/src/jit-test/tests/wasm/gc/regress-1884767.js b/js/src/jit-test/tests/wasm/gc/regress-1884767.js
new file mode 100644
index 0000000000..54a168d657
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/regress-1884767.js
@@ -0,0 +1,13 @@
+// |jit-test| skip-if: !wasmGcEnabled()
+
+const { test } = wasmEvalText(`(module
+  (type $a (array i32))
+  (func (export "test") (result anyref)
+    try (result anyref)
+      (array.new_default $a (i32.const 999999999))
+    catch_all
+      unreachable
+    end
+  )
+)`).exports;
+assertErrorMessage(() => test(), WebAssembly.RuntimeError, /too many array elements/);
diff --git a/js/src/jit-test/tests/wasm/gc/structs.js b/js/src/jit-test/tests/wasm/gc/structs.js
index 0ff0cbd4b4..15dab873e9 100644
--- a/js/src/jit-test/tests/wasm/gc/structs.js
+++ b/js/src/jit-test/tests/wasm/gc/structs.js
@@ -665,46 +665,6 @@ assertErrorMessage(() => new WebAssembly.Module(bad),
     let exports = wasmEvalText(txt).exports;
 }
 
-//////////////////////////////////////////////////////////////////////////////
-//
-// Checks for requests to create structs with more than MaxStructFields, where
-// MaxStructFields == 1000.
-
-function structNewOfManyFields(numFields) {
-    let defString = "(type $s (struct ";
-    for (i = 0; i < numFields; i++) {
-        defString += "(field i32) ";
-    }
-    defString += "))";
-
-    let insnString = "(struct.new $s ";
-    for (i = 0; i < numFields; i++) {
-        insnString += "(i32.const 1337) ";
-    }
-    insnString += ")";
-
-    return "(module " +
-           defString +
-           " (func (export \"create\") (result eqref) " +
-           insnString +
-           "))";
-}
-
-{
-    // 10_000 fields is allowable
-    let exports = wasmEvalText(structNewOfManyFields(10000)).exports;
-    let s = exports.create();
-    assertEq(s, s);
-}
-{
-    // but 10_001 is not
-    assertErrorMessage(() => wasmEvalText(structNewOfManyFields(10001)),
-                       WebAssembly.CompileError,
-                       /too many fields in struct/);
-}
-
-// FIXME: also check struct.new_default, once it is available in both compilers.
-
 // Exercise stack maps and GC
 {
   // Zeal will cause us to allocate structs via instance call, requiring live registers