[wasm] minimum and inital parameter for table constructor are exclusive

See https://github.com/WebAssembly/js-types/blob/main/document/js-api/index.bs#L866

R=manoskouk@chromium.org

Bug: v8:12227
Change-Id: I384483a7568d37c40d077487165ff9b1761da342
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172768Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76995}

src/wasm/wasm-js.cc

@@ -1062,7 +1062,7 @@ bool GetOptionalIntegerProperty(v8::Isolate* isolate, ErrorThrower* thrower,
 }
 
 // Fetch 'initial' or 'minimum' property from object. If both are provided,
-// 'initial' is used.
+// a TypeError is thrown.
 // TODO(aseemgarg): change behavior when the following bug is resolved:
 // https://github.com/WebAssembly/js-types/issues/6
 bool GetInitialOrMinimumProperty(v8::Isolate* isolate, ErrorThrower* thrower,
@@ -1075,13 +1075,27 @@ bool GetInitialOrMinimumProperty(v8::Isolate* isolate, ErrorThrower* thrower,
                                   result, lower_bound, upper_bound)) {
     return false;
   }
-  auto enabled_features = i::wasm::WasmFeatures::FromFlags();
-  if (!has_initial && enabled_features.has_type_reflection()) {
+  auto enabled_features = i::wasm::WasmFeatures::FromIsolate(
+      reinterpret_cast<i::Isolate*>(isolate));
+  if (enabled_features.has_type_reflection()) {
+    bool has_minimum = false;
+    int64_t minimum = 0;
     if (!GetOptionalIntegerProperty(isolate, thrower, context, object,
-                                    v8_str(isolate, "minimum"), &has_initial,
-                                    result, lower_bound, upper_bound)) {
+                                    v8_str(isolate, "minimum"), &has_minimum,
+                                    &minimum, lower_bound, upper_bound)) {
+      return false;
+    }
+    if (has_initial && has_minimum) {
+      thrower->TypeError(
+          "The properties 'initial' and 'minimum' are not allowed at the same "
+          "time");
       return false;
     }
+    if (has_minimum) {
+      // Only {minimum} exists, so we use {minimum} as {initial}.
+      has_initial = true;
+      *result = minimum;
+    }
   }
   if (!has_initial) {
     // TODO(aseemgarg): update error message when the spec issue is resolved.
@@ -1129,7 +1143,7 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
     if (!maybe.ToLocal(&value)) return;
     v8::Local<v8::String> string;
     if (!value->ToString(context).ToLocal(&string)) return;
-    auto enabled_features = i::wasm::WasmFeatures::FromFlags();
+    auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
     // The JS api uses 'anyfunc' instead of 'funcref'.
     if (string->StringEquals(v8_str(isolate, "anyfunc"))) {
       type = i::wasm::kWasmFuncRef;

test/mjsunit/wasm/type-reflection.js

@@ -219,21 +219,22 @@ d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
   assertEquals(false, type.shared);
   assertEquals(3, Object.getOwnPropertyNames(type).length);
 
-  mem = new WebAssembly.Memory({minimum: 1, initial: 2});
+  mem = new WebAssembly.Memory({initial: 1, maximum: 5, shared: true});
   assertTrue(mem instanceof WebAssembly.Memory);
   type = mem.type();
-  assertEquals(2, type.minimum);
-  assertEquals(false, type.shared);
-  assertEquals(2, Object.getOwnPropertyNames(type).length);
-
-  mem = new WebAssembly.Memory(
-      {minimum: 1, initial: 2, maximum: 5, shared: true});
-  assertTrue(mem instanceof WebAssembly.Memory);
-  type = mem.type();
-  assertEquals(2, type.minimum);
+  assertEquals(1, type.minimum);
   assertEquals(5, type.maximum);
   assertEquals(true, type.shared);
   assertEquals(3, Object.getOwnPropertyNames(type).length);
+
+  assertThrows(
+      () => new WebAssembly.Memory({minimum: 1, initial: 2}), TypeError,
+      /The properties 'initial' and 'minimum' are not allowed at the same time/);
+
+  assertThrows(
+      () => new WebAssembly.Memory({minimum: 1, initial: 2, maximum: 5}),
+      TypeError,
+      /The properties 'initial' and 'minimum' are not allowed at the same time/);
 })();
 
 (function TestTableConstructorWithMinimum() {
@@ -252,21 +253,16 @@ d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
   assertEquals('anyfunc', type.element);
   assertEquals(3, Object.getOwnPropertyNames(type).length);
 
-  table = new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc'});
-  assertTrue(table instanceof WebAssembly.Table);
-  type = table.type();
-  assertEquals(2, type.minimum);
-  assertEquals('anyfunc', type.element);
-  assertEquals(2, Object.getOwnPropertyNames(type).length);
+  assertThrows(
+      () => new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc'}),
+      TypeError,
+      /The properties 'initial' and 'minimum' are not allowed at the same time/);
 
-  table = new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc',
-                                 maximum: 5});
-  assertTrue(table instanceof WebAssembly.Table);
-  type = table.type();
-  assertEquals(2, type.minimum);
-  assertEquals(5, type.maximum);
-  assertEquals('anyfunc', type.element);
-  assertEquals(3, Object.getOwnPropertyNames(type).length);
+  assertThrows(
+      () => new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc',
+                                 maximum: 5}),
+      TypeError,
+      /The properties 'initial' and 'minimum' are not allowed at the same time/);
 })();
 
 (function TestFunctionConstructor() {

test/wasm-js/wasm-js.status

@@ -15,16 +15,16 @@
   'wpt/function/constructor.tentative': [FAIL],
   'wpt/function/table.tentative': [FAIL],
   'wpt/function/type.tentative': [FAIL],
-  'wpt/memory/constructor-types.tentative': [FAIL],
-  'wpt/memory/types.tentative': [FAIL],
-  'wpt/table/constructor-types.tentative': [FAIL],
-  'wpt/table/grow-reftypes.tentative': [FAIL],
 
   # Outdated proposal tests.
   'proposals/js-types/table/get-set': [FAIL],
   'proposals/memory64/table/get-set': [FAIL],
   'proposals/simd/table/get-set': [FAIL],
   'proposals/tail-call/table/get-set': [FAIL],
+  'proposals/js-types/memory/constructor': [FAIL],
+  'proposals/memory64/memory/constructor': [FAIL],
+  'proposals/simd/memory/constructor': [FAIL],
+  'proposals/tail-call/memory/constructor': [FAIL],
 
   # TODO(v8:10556): Remove sub-typing in the reference-types implementation
   'proposals/js-types/constructor/instantiate': [FAIL],