summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/wasm/gc
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/wasm/gc')
-rw-r--r--js/src/jit-test/tests/wasm/gc/arrays.js143
-rw-r--r--js/src/jit-test/tests/wasm/gc/binary.js16
-rw-r--r--js/src/jit-test/tests/wasm/gc/bug-1843295.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/bug-1845436.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/bug-1854007.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/bug-1879096.js65
-rw-r--r--js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/directives.txt2
-rw-r--r--js/src/jit-test/tests/wasm/gc/disabled.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/ion-and-baseline.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits.js69
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js9
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/load-mod.js5
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/struct-fields.js11
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js13
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/types-1.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/types-2.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/types-3.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/limits/types-4.js6
-rw-r--r--js/src/jit-test/tests/wasm/gc/ref.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/regress-1754701.js2
-rw-r--r--js/src/jit-test/tests/wasm/gc/regress-1884767.js13
-rw-r--r--js/src/jit-test/tests/wasm/gc/structs.js40
25 files changed, 313 insertions, 125 deletions
diff --git a/js/src/jit-test/tests/wasm/gc/arrays.js b/js/src/jit-test/tests/wasm/gc/arrays.js
index b3f03151bb..cb61bb1b07 100644
--- a/js/src/jit-test/tests/wasm/gc/arrays.js
+++ b/js/src/jit-test/tests/wasm/gc/arrays.js
@@ -604,6 +604,51 @@ assertErrorMessage(() => wasmEvalText(`(module
},WebAssembly.RuntimeError, /index out of bounds/);
}
+// run: zero-length copies are allowed
+{
+ let { newData } = wasmEvalText(`(module
+ (type $a (array i8))
+ (data $d "1337")
+ (func (export "newData") (result eqref)
+ (; offset=0 into data ;) i32.const 0
+ (; size=0 into data ;) i32.const 0
+ array.new_data $a $d
+ )
+ )`).exports;
+ let arr = newData();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: a zero-length copy from the end is allowed
+{
+ let { newData } = wasmEvalText(`(module
+ (type $a (array i8))
+ (data $d "1337")
+ (func (export "newData") (result eqref)
+ (; offset=4 into data ;) i32.const 4
+ (; size=0 into data ;) i32.const 0
+ array.new_data $a $d
+ )
+ )`).exports;
+ let arr = newData();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: even empty data segments are allowed
+{
+ let { newData } = wasmEvalText(`(module
+ (type $a (array i8))
+ (data $d "")
+ (func (export "newData") (result eqref)
+ (; offset=0 into data ;) i32.const 0
+ (; size=0 into data ;) i32.const 0
+ array.new_data $a $d
+ )
+ )`).exports;
+ let arr = newData();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
// run: resulting array is as expected
{
let { newData } = wasmEvalText(`(module
@@ -802,6 +847,59 @@ assertErrorMessage(() => wasmEvalText(`(module
},WebAssembly.RuntimeError, /index out of bounds/);
}
+// run: zero-length copies are allowed
+{
+ let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+ (type $a (array funcref))
+ (elem $e func $f1 $f2 $f3 $f4)
+ (func $f1 (export "f1"))
+ (func $f2 (export "f2"))
+ (func $f3 (export "f3"))
+ (func $f4 (export "f4"))
+ (func (export "newElem") (result eqref)
+ (; offset=0 into elem ;) i32.const 0
+ (; size=0 into elem ;) i32.const 0
+ array.new_elem $a $e
+ )
+ )`).exports;
+ let arr = newElem();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: a zero-length copy from the end is allowed
+{
+ let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+ (type $a (array funcref))
+ (elem $e func $f1 $f2 $f3 $f4)
+ (func $f1 (export "f1"))
+ (func $f2 (export "f2"))
+ (func $f3 (export "f3"))
+ (func $f4 (export "f4"))
+ (func (export "newElem") (result eqref)
+ (; offset=4 into elem ;) i32.const 4
+ (; size=0 into elem ;) i32.const 0
+ array.new_elem $a $e
+ )
+ )`).exports;
+ let arr = newElem();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
+// run: even empty elem segments are allowed
+{
+ let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+ (type $a (array funcref))
+ (elem $e func)
+ (func (export "newElem") (result eqref)
+ (; offset=0 into elem ;) i32.const 0
+ (; size=0 into elem ;) i32.const 0
+ array.new_elem $a $e
+ )
+ )`).exports;
+ let arr = newElem();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
// run: resulting array is as expected
{
let { newElem, f1, f2, f3, f4 } = wasmEvalText(`(module
@@ -1130,6 +1228,29 @@ assertErrorMessage(() => wasmEvalText(`(module
},WebAssembly.RuntimeError, /index out of bounds/);
}
+// run: zeroes everywhere
+{
+ let { initData } = wasmEvalText(`(module
+ (type $a (array (mut i8)))
+ (data $d "")
+ (func (export "initData") (result eqref)
+ (local $arr (ref $a))
+ (local.set $arr (array.new_default $a (i32.const 0)))
+
+ (; array to init ;) local.get $arr
+ (; offset=0 into array ;) i32.const 0
+ (; offset=0 into data ;) i32.const 0
+ (; size=0 elements ;) i32.const 0
+ array.init_data $a $d
+
+ local.get $arr
+ )
+ (func data.drop 0) ;; force write of data count section, see https://github.com/bytecodealliance/wasm-tools/pull/1194
+ )`).exports;
+ let arr = initData();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
// run: resulting array is as expected
{
let { initData } = wasmEvalText(`(module
@@ -1488,6 +1609,28 @@ assertErrorMessage(() => wasmEvalText(`(module
},WebAssembly.RuntimeError, /index out of bounds/);
}
+// run: zeroes everywhere
+{
+ let { initElem, f1, f2, f3, f4 } = wasmEvalText(`(module
+ (type $a (array (mut funcref)))
+ (elem $e func)
+ (func (export "initElem") (result eqref)
+ (local $arr (ref $a))
+ (local.set $arr (array.new_default $a (i32.const 0)))
+
+ (; array to init ;) local.get $arr
+ (; offset=0 into array ;) i32.const 0
+ (; offset=0 into elem ;) i32.const 0
+ (; size=0 into elem ;) i32.const 0
+ array.init_elem $a $e
+
+ local.get $arr
+ )
+ )`).exports;
+ let arr = initElem();
+ assertEq(wasmGcArrayLength(arr), 0);
+}
+
// run: resulting array is as expected
{
let { initElem, f1, f2, f3, f4 } = wasmEvalText(`(module
diff --git a/js/src/jit-test/tests/wasm/gc/binary.js b/js/src/jit-test/tests/wasm/gc/binary.js
index 1ef4a586a8..e16af2bfbf 100644
--- a/js/src/jit-test/tests/wasm/gc/binary.js
+++ b/js/src/jit-test/tests/wasm/gc/binary.js
@@ -2,14 +2,16 @@
load(libdir + "wasm-binary.js");
-const v2vSig = {args:[], ret:VoidCode};
-const v2vSigSection = sigSection([v2vSig]);
-
function checkInvalid(body, errorMessage) {
assertErrorMessage(() => new WebAssembly.Module(
- moduleWithSections([v2vSigSection, declSection([0]), bodySection([body])])),
- WebAssembly.CompileError,
- errorMessage);
+ moduleWithSections([
+ typeSection([
+ { kind: FuncCode, args: [], ret: [] },
+ ]),
+ declSection([0]),
+ bodySection([body]),
+ ])
+ ), WebAssembly.CompileError, errorMessage);
}
const invalidRefBlockType = funcBody({locals:[], body:[
@@ -23,7 +25,7 @@ checkInvalid(invalidRefBlockType, /heap type/);
const invalidTooBigRefType = funcBody({locals:[], body:[
BlockCode,
OptRefCode,
- varU32(1000000),
+ ...varU32(1000000),
EndCode,
]});
checkInvalid(invalidTooBigRefType, /heap type/);
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1843295.js b/js/src/jit-test/tests/wasm/gc/bug-1843295.js
index 19a32263f6..765a9000a1 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1843295.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1843295.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled(); --wasm-test-serialization
+// |jit-test| skip-if: !wasmGcEnabled(); --setpref=wasm_test_serialization=true
wasmEvalText(`(module
(type (sub (array (mut i32))))
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1845436.js b/js/src/jit-test/tests/wasm/gc/bug-1845436.js
index a79c22d9a1..6ea8070f4d 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1845436.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1845436.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled(); --wasm-test-serialization
+// |jit-test| skip-if: !wasmGcEnabled(); --setpref=wasm_test_serialization=true
// Test that serialization doesn't create a forward reference to the third
// struct when serializing the reference to the first struct, which is
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1854007.js b/js/src/jit-test/tests/wasm/gc/bug-1854007.js
index c9d6b25369..d3e5afa9cd 100644
--- a/js/src/jit-test/tests/wasm/gc/bug-1854007.js
+++ b/js/src/jit-test/tests/wasm/gc/bug-1854007.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--wasm-test-serialization; skip-if: !wasmGcEnabled()
+// |jit-test| test-also=--setpref=wasm_test_serialization=true; skip-if: !wasmGcEnabled()
let {run} = wasmEvalText(`(module
(rec (type $$t1 (func (result (ref null $$t1)))))
diff --git a/js/src/jit-test/tests/wasm/gc/bug-1879096.js b/js/src/jit-test/tests/wasm/gc/bug-1879096.js
new file mode 100644
index 0000000000..e71d2bac27
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/bug-1879096.js
@@ -0,0 +1,65 @@
+// |jit-test| test-also=--setpref=wasm_test_serialization; skip-if: !wasmGcEnabled()
+
+// Conditional branch instructions need to rewrite their stack types according
+// to the destination label types. This loses information but is mandated by
+// the spec.
+
+// br_if
+wasmFailValidateText(`(module
+ (func (result anyref)
+ ref.null array ;; stack: [arrayref]
+ ref.null struct ;; stack: [arrayref structref]
+ i32.const 0 ;; stack: [arrayref structref i32]
+ br_if 0 ;; stack: [arrayref anyref]
+ ref.eq ;; should fail (anyref is not eq)
+ unreachable
+ )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_null
+wasmFailValidateText(`(module
+ (func (param externref) (result anyref)
+ ref.null array ;; stack: [arrayref]
+ local.get 0 ;; stack: [arrayref externref]
+ br_on_null 0 ;; stack: [anyref (ref extern)]
+ drop ;; stack: [anyref]
+ array.len ;; should fail
+ unreachable
+ )
+)`, /type mismatch: expression has type anyref but expected arrayref/);
+
+// br_on_non_null
+wasmFailValidateText(`(module
+ (func (param externref) (result anyref (ref extern))
+ ref.null array ;; stack: [arrayref]
+ ref.null struct ;; stack: [arrayref structref]
+ local.get 0 ;; stack: [arrayref structref externref]
+ br_on_non_null 0 ;; stack: [arrayref anyref]
+ ref.eq ;; should fail (anyref is not eq)
+ unreachable
+ )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_cast
+wasmFailValidateText(`(module
+ (type $s (struct))
+ (func (result anyref (ref $s))
+ ref.null array ;; stack: [arrayref]
+ ref.null struct ;; stack: [arrayref structref]
+ br_on_cast 0 structref (ref $s) ;; stack: [anyref structref]
+ ref.eq ;; should fail (anyref is not eq)
+ unreachable
+ )
+)`, /type mismatch: expression has type anyref but expected eqref/);
+
+// br_on_cast_fail
+wasmFailValidateText(`(module
+ (type $s (struct))
+ (func (result anyref anyref)
+ ref.null array ;; stack: [arrayref]
+ ref.null struct ;; stack: [arrayref structref]
+ br_on_cast_fail 0 structref (ref $s) ;; stack: [anyref (ref $s)]
+ ref.eq ;; should fail (anyref is not eq)
+ unreachable
+ )
+)`, /type mismatch: expression has type anyref but expected eqref/);
diff --git a/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js b/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
index 4301621a8c..d83f2ed624 100644
--- a/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
+++ b/js/src/jit-test/tests/wasm/gc/call-indirect-subtyping.js
@@ -1,4 +1,4 @@
-// |jit-test| test-also=--wasm-tail-calls; skip-if: !wasmGcEnabled()
+// |jit-test| test-also=--setpref=wasm_tail_calls=true; skip-if: !wasmGcEnabled()
// Test that call_indirect will respect subtyping by defining a bunch of types
// and checking every combination of (expected, actual) type.
diff --git a/js/src/jit-test/tests/wasm/gc/directives.txt b/js/src/jit-test/tests/wasm/gc/directives.txt
index e6d978cc44..293724e57a 100644
--- a/js/src/jit-test/tests/wasm/gc/directives.txt
+++ b/js/src/jit-test/tests/wasm/gc/directives.txt
@@ -1 +1 @@
-|jit-test| --wasm-gc; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js
+|jit-test| test-also=--setpref=wasm_gc=true; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js
diff --git a/js/src/jit-test/tests/wasm/gc/disabled.js b/js/src/jit-test/tests/wasm/gc/disabled.js
index 791c6ff25e..206d32b1c4 100644
--- a/js/src/jit-test/tests/wasm/gc/disabled.js
+++ b/js/src/jit-test/tests/wasm/gc/disabled.js
@@ -2,7 +2,7 @@
const { CompileError, validate } = WebAssembly;
-const UNRECOGNIZED_OPCODE_OR_BAD_TYPE = /unrecognized opcode|(Structure|reference|gc) types not enabled|invalid heap type|invalid inline block type|bad type|\(ref T\) types not enabled|Invalid type|invalid function type/;
+const UNRECOGNIZED_OPCODE_OR_BAD_TYPE = /unrecognized opcode|gc not enabled|invalid heap type|invalid inline block type|bad type|Invalid type|invalid function type/;
let simpleTests = [
"(module (func (drop (ref.null eq))))",
diff --git a/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js b/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
index 5a4951c585..2c67bbce8b 100644
--- a/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
+++ b/js/src/jit-test/tests/wasm/gc/ion-and-baseline.js
@@ -10,7 +10,7 @@
// actually testing something here.
//
// Some logging with printf confirms that refmod is baseline-compiled and
-// nonrefmod is ion-compiled at present, with --wasm-gc enabled.
+// nonrefmod is ion-compiled at present, with --setpref=wasm_gc=true enabled.
var refmod = new WebAssembly.Module(wasmTextToBinary(
`(module
diff --git a/js/src/jit-test/tests/wasm/gc/limits.js b/js/src/jit-test/tests/wasm/gc/limits.js
deleted file mode 100644
index e6f21b5d6b..0000000000
--- a/js/src/jit-test/tests/wasm/gc/limits.js
+++ /dev/null
@@ -1,69 +0,0 @@
-// |jit-test| skip-if: !wasmGcEnabled() || getBuildConfiguration("tsan")
-
-// This test has a timeout on TSAN configurations due to the large
-// allocations.
-
-// Limit of 1 million recursion groups
-wasmValidateText(`(module
- ${`(rec (type (func)))`.repeat(1_000_000)}
- )`);
-wasmFailValidateText(`(module
- ${`(rec (type (func)))`.repeat(1_000_001)}
- )`, /too many/);
-
-// Limit of 1 million types (across all recursion groups)
-wasmValidateText(`(module
- (rec ${`(type (func))`.repeat(1_000_000)})
- )`);
-wasmValidateText(`(module
- (rec ${`(type (func))`.repeat(500_000)})
- (rec ${`(type (func))`.repeat(500_000)})
- )`);
-wasmFailValidateText(`(module
- (rec ${`(type (func))`.repeat(1_000_001)})
- )`, /too many/);
-wasmFailValidateText(`(module
- (rec ${`(type (func))`.repeat(500_000)})
- (rec ${`(type (func))`.repeat(500_001)})
- )`, /too many/);
-
-// Limit of subtyping hierarchy 63 deep
-function testSubtypingModule(depth) {
- let types = '(type (sub (func)))';
- for (let i = 1; i <= depth; i++) {
- types += `(type (sub ${i - 1} (func)))`;
- }
- return `(module
- ${types}
- )`;
-}
-wasmValidateText(testSubtypingModule(63));
-wasmFailValidateText(testSubtypingModule(64), /too deep/);
-
-// Limit of 10_000 struct fields
-wasmFailValidateText(`(module
- (type (struct ${'(field i64)'.repeat(10_001)}))
-)`, /too many/);
-
-{
- let {makeLargeStructDefault, makeLargeStruct} = wasmEvalText(`(module
- (type $s (struct ${'(field i64)'.repeat(10_000)}))
- (func (export "makeLargeStructDefault") (result anyref)
- struct.new_default $s
- )
- (func (export "makeLargeStruct") (result anyref)
- ${'i64.const 0 '.repeat(10_000)}
- struct.new $s
- )
- )`).exports;
- let largeStructDefault = makeLargeStructDefault();
- let largeStruct = makeLargeStruct();
-}
-
-// array.new_fixed has limit of 10_000 operands
-wasmFailValidateText(`(module
- (type $a (array i32))
- (func
- array.new_fixed $a 10001
- )
-)`, /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
new file mode 100644
index 0000000000..4b0600c724
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/array-new-fixed.js
@@ -0,0 +1,9 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+// array.new_fixed has limit of 10_000 operands
+wasmFailValidateText(`(module
+ (type $a (array i32))
+ (func
+ array.new_fixed $a 10001
+ )
+)`, /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/load-mod.js b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
new file mode 100644
index 0000000000..cd972ceb65
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/load-mod.js
@@ -0,0 +1,5 @@
+// Files for some of these tests are pre-generated and located in js/src/jit-test/lib/gen.
+// There you will also find the script to update these files.
+function loadMod(name) {
+ return decompressLZ4(os.file.readFile(libdir + "gen/" + name, "binary").buffer)
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
new file mode 100644
index 0000000000..489bf89cd4
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmValidateBinary(loadMod("wasm-gc-limits-r1M-t1.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
new file mode 100644
index 0000000000..40c020c4b5
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/rec-groups-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million recursion groups
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1M1-t1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
new file mode 100644
index 0000000000..ae60f38d57
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/struct-fields.js
@@ -0,0 +1,11 @@
+// |jit-test| --setpref=wasm_gc; test-also=--wasm-compiler=optimizing; test-also=--wasm-compiler=baseline; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 10_000 struct fields
+wasmFailValidateBinary(loadMod("wasm-gc-limits-s10K1.wasm"), /too many/);
+{
+ let {makeLargeStructDefault, makeLargeStruct} = wasmEvalBinary(loadMod("wasm-gc-limits-s10K.wasm")).exports;
+ let largeStructDefault = makeLargeStructDefault();
+ let largeStruct = makeLargeStruct();
+}
diff --git a/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
new file mode 100644
index 0000000000..2d70215ee9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/subtyping-depth.js
@@ -0,0 +1,13 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js; include: wasm-binary.js;
+
+// Limit of subtyping hierarchy 63 deep
+function moduleSubtypingDepth(depth) {
+ let types = [];
+ types.push({final: false, kind: FuncCode, args: [], ret: []});
+ for (let i = 1; i <= depth; i++) {
+ types.push({final: false, sub: i - 1, kind: FuncCode, args: [], ret: []});
+ }
+ return moduleWithSections([typeSection(types)]);
+}
+wasmValidateBinary(moduleSubtypingDepth(63));
+wasmFailValidateBinary(moduleSubtypingDepth(64), /too deep/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-1.js b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
new file mode 100644
index 0000000000..c097907e79
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-1.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r1-t1M.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-2.js b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
new file mode 100644
index 0000000000..5e81bdf6ab
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-2.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmValidateBinary(loadMod("wasm-gc-limits-r2-t500K.wasm"));
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-3.js b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
new file mode 100644
index 0000000000..e9effa4bfa
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-3.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r1-t1M1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/limits/types-4.js b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
new file mode 100644
index 0000000000..dd413ed4e9
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/limits/types-4.js
@@ -0,0 +1,6 @@
+// |jit-test| --setpref=wasm_gc; include:wasm.js;
+
+loadRelativeToScript("load-mod.js");
+
+// Limit of 1 million types (across all recursion groups)
+wasmFailValidateBinary(loadMod("wasm-gc-limits-r2-t500K1.wasm"), /too many/);
diff --git a/js/src/jit-test/tests/wasm/gc/ref.js b/js/src/jit-test/tests/wasm/gc/ref.js
index a55b0c8f02..2bf76daf52 100644
--- a/js/src/jit-test/tests/wasm/gc/ref.js
+++ b/js/src/jit-test/tests/wasm/gc/ref.js
@@ -173,7 +173,7 @@ assertErrorMessage(() => wasmEvalText(`
`),
WebAssembly.CompileError, /expression has type \(ref null.*\) but expected \(ref null.*\)/);
-if (!wasmFunctionReferencesEnabled()) {
+if (!wasmGcEnabled()) {
// Ref type can't reference a function type
assertErrorMessage(() => wasmEvalText(`
diff --git a/js/src/jit-test/tests/wasm/gc/regress-1754701.js b/js/src/jit-test/tests/wasm/gc/regress-1754701.js
index 656aa5d625..1a2307fa87 100644
--- a/js/src/jit-test/tests/wasm/gc/regress-1754701.js
+++ b/js/src/jit-test/tests/wasm/gc/regress-1754701.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !wasmGcEnabled() || !('oomTest' in this)
+// |jit-test| skip-if: !wasmGcEnabled()
let { testArray, testStructInline, testStructOutline } = wasmEvalText(`
(module
diff --git a/js/src/jit-test/tests/wasm/gc/regress-1884767.js b/js/src/jit-test/tests/wasm/gc/regress-1884767.js
new file mode 100644
index 0000000000..54a168d657
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/gc/regress-1884767.js
@@ -0,0 +1,13 @@
+// |jit-test| skip-if: !wasmGcEnabled()
+
+const { test } = wasmEvalText(`(module
+ (type $a (array i32))
+ (func (export "test") (result anyref)
+ try (result anyref)
+ (array.new_default $a (i32.const 999999999))
+ catch_all
+ unreachable
+ end
+ )
+)`).exports;
+assertErrorMessage(() => test(), WebAssembly.RuntimeError, /too many array elements/);
diff --git a/js/src/jit-test/tests/wasm/gc/structs.js b/js/src/jit-test/tests/wasm/gc/structs.js
index 0ff0cbd4b4..15dab873e9 100644
--- a/js/src/jit-test/tests/wasm/gc/structs.js
+++ b/js/src/jit-test/tests/wasm/gc/structs.js
@@ -665,46 +665,6 @@ assertErrorMessage(() => new WebAssembly.Module(bad),
let exports = wasmEvalText(txt).exports;
}
-//////////////////////////////////////////////////////////////////////////////
-//
-// Checks for requests to create structs with more than MaxStructFields, where
-// MaxStructFields == 1000.
-
-function structNewOfManyFields(numFields) {
- let defString = "(type $s (struct ";
- for (i = 0; i < numFields; i++) {
- defString += "(field i32) ";
- }
- defString += "))";
-
- let insnString = "(struct.new $s ";
- for (i = 0; i < numFields; i++) {
- insnString += "(i32.const 1337) ";
- }
- insnString += ")";
-
- return "(module " +
- defString +
- " (func (export \"create\") (result eqref) " +
- insnString +
- "))";
-}
-
-{
- // 10_000 fields is allowable
- let exports = wasmEvalText(structNewOfManyFields(10000)).exports;
- let s = exports.create();
- assertEq(s, s);
-}
-{
- // but 10_001 is not
- assertErrorMessage(() => wasmEvalText(structNewOfManyFields(10001)),
- WebAssembly.CompileError,
- /too many fields in struct/);
-}
-
-// FIXME: also check struct.new_default, once it is available in both compilers.
-
// Exercise stack maps and GC
{
// Zeal will cause us to allocate structs via instance call, requiring live registers