Do not pop from the polymorphic stack (was: Parse expection on unreachable struct.set)

Reproduce the failure with the linked stubbed.wasm.gz module and the offending sequence: unreachable, global.get 43, ref.cast, struct.set $context 5. Trace how parsing handles the polymorphic stack after unreachable; done means the sequence is accepted in all valid contexts without the reported parse exception.

When processing this module using https://github.com/WebAssembly/binaryen/commit/a4ab1c7ee7376977ca09e2d3c4358893e9fdfce2, I get the following error:

[parse exception: bad heap type: expected (struct (field (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...1) (mut i64) (mut (ref null (struct (field (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i64))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref) (result (ref null (struct (field (mut i32))))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref (ref null (struct (field (mut i32)))) (ref null (struct (field (mut i32))))) (result (ref null (struct (field (mut i32))))))))))) (mut ...3) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) ..!)))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut i64) (mut i32) (mut ..!) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32))))) (mut i64) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32))) but found (ref (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32)))))))) (at 0:259577)]
Fatal: error parsing wasm

The offending instruction sequence is:

(unreachable)
(global.get 43)
(ref.cast)
(struct.set $context 5)

Due to the unreachable, this sequence should be valid in all contexts, since it is valid if it would be valid for any stack contents. V8 accepts the code.

I tried to construct a smaller example, but my simpler cases did not trigger the error. I stubbed all other functions in the module to cut down on the size a bit.

By the way, how come this is a parse error, rather than a validation error? It could be useful to be able to disable such checks using --no-validation.