[webkit-changes] [WebKit/WebKit] abb320: [JSC] Limit wasm function return type counts to 1000

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: abb3206604d2870d3f29155f57b3a142f7171375
      https://github.com/WebKit/WebKit/commit/abb3206604d2870d3f29155f57b3a142f7171375
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-08-08 (Tue, 08 Aug 2023)

  Changed paths:
    M JSTests/wasm/stress/big-tuple-args.js
    M JSTests/wasm/stress/big-tuple.js
    A JSTests/wasm/stress/too-many-return-types.js
    M Source/JavaScriptCore/wasm/WasmLimits.h
    M Source/JavaScriptCore/wasm/WasmSectionParser.cpp

  Log Message:
  -----------
  [JSC] Limit wasm function return type counts to 1000
https://bugs.webkit.org/show_bug.cgi?id=259957
rdar://113595096

Reviewed by Justin Michaud and Keith Miller.

This patch integrates wasm function's return type count limits, 1000, this number is aligned to V8 and SpiderMonkey.
We also fix the existing bug about returnCount in WasmSectionParser. This is harmless since it is just "reserve" capacity, but anyway this was wrong.

* JSTests/wasm/stress/too-many-return-types.js: Added.
(import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
* Source/JavaScriptCore/wasm/WasmLimits.h:
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseFunctionType):

Canonical link: https://commits.webkit.org/266709@main