[WGSL] Validate maximum array size

https://bugs.webkit.org/show_bug.cgi?id=270313
rdar://123852286

Reviewed by Mike Wyrzykowski and Alex Christensen.

Fix 2 issues with array sizes:
- the size was being treated as unsigned and only checking for 0, but according
  to the spec the size can also be signed, and we should return an error for
  negative values
- we also need to limit the maximum size of an array. the spec[1] says the minimum
  size we must support is 65535 bytes, but for now we just check for 65535 elements.

[1]: https://www.w3.org/TR/WGSL/#limits

* Source/WebGPU/WGSL/TypeCheck.cpp:
(WGSL::TypeChecker::visit):
* Source/WebGPU/WGSL/tests/invalid/array.wgsl:

Canonical link: https://commits.webkit.org/275557@main

Source/WebGPU/WGSL/TypeCheck.cpp

@@ -1405,12 +1405,18 @@ void TypeChecker::visit(AST::CallExpression& call)
                 return;
             }
 
-            elementCount = constantValue->integerValue();
-            if (!elementCount) {
+            auto intElementCount = constantValue->integerValue();
+            if (intElementCount < 1) {
                 typeError(call.span(), "array count must be greater than 0");
                 return;
             }
 
+            if (intElementCount > std::numeric_limits<uint16_t>::max()) {
+                typeError(call.span(), "array count (", String::number(intElementCount), ") must be less than 65536");
+                return;
+            }
+            elementCount = static_cast<unsigned>(intElementCount);
+
             unsigned numberOfArguments = call.arguments().size();
             if (numberOfArguments && numberOfArguments != elementCount) {
                 const char* errorKind = call.arguments().size() < elementCount ? "few" : "many";
@@ -1670,9 +1676,14 @@ void TypeChecker::visit(AST::ArrayTypeExpression& array)
         }
 
         auto value = array.maybeElementCount()->constantValue();
-        if (value.has_value())
-            size = { static_cast<unsigned>(value->integerValue()) };
-        else
+        if (value.has_value()) {
+            auto elementCount = value->integerValue();
+            if (elementCount < 1) {
+                typeError(array.span(), "array count must be greater than 0");
+                return;
+            }
+            size = { static_cast<unsigned>(elementCount) };
+        } else
             size = { array.maybeElementCount() };
     }
 

Source/WebGPU/WGSL/tests/invalid/array.wgsl

@@ -7,11 +7,20 @@ fn testArrayLengthMismatch() {
   // CHECK-L: array count must be greater than 0
   let x1 = array<i32, 0>();
 
+  // CHECK-L: array count must be greater than 0
+  let x2 = array<i32, -1>();
+
   // CHECK-L: array constructor has too few elements: expected 2, found 1
-  let x2 = array<i32, 2>(0);
+  let x3 = array<i32, 2>(0);
 
   // CHECK-L: array constructor has too many elements: expected 1, found 2
-  let x3 = array<i32, 1>(0, 0);
+  let x4 = array<i32, 1>(0, 0);
+
+  // CHECK-L: array count (65536) must be less than 65536
+  let x5 = array<i32, 65536>();
+
+  // CHECK-NOT-L: array count (65535) must be less than 65536
+  let x6 = array<i32, 65535>();
 
 }