Do not pop from the polymorphic stack (was: Parse expection on unreachable struct.set)

Riproduci il fallimento con il modulo stubbed.wasm.gz collegato e la sequenza problematica: unreachable, global.get 43, ref.cast, struct.set $context 5. Traccia il modo in cui il parsing gestisce lo stack polimorfico dopo unreachable; il lavoro è completato quando la sequenza viene accettata in tutti i contesti validi senza l’eccezione di parsing segnalata.

When processing this module using https://github.com/WebAssembly/binaryen/commit/a4ab1c7ee7376977ca09e2d3c4358893e9fdfce2, I get the following error:

[parse exception: bad heap type: expected (struct (field (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...1) (mut i64) (mut (ref null (struct (field (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i64))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref) (result (ref null (struct (field (mut i32))))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref (ref null (struct (field (mut i32)))) (ref null (struct (field (mut i32))))) (result (ref null (struct (field (mut i32))))))))))) (mut ...3) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) ..!)))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut i64) (mut i32) (mut ..!) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32))))) (mut i64) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32))) but found (ref (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32)))))))) (at 0:259577)]
Fatal: error parsing wasm

The offending instruction sequence is:

(unreachable)
(global.get 43)
(ref.cast)
(struct.set $context 5)

Due to the unreachable, this sequence should be valid in all contexts, since it is valid if it would be valid for any stack contents. V8 accepts the code.

I tried to construct a smaller example, but my simpler cases did not trigger the error. I stubbed all other functions in the module to cut down on the size a bit.

By the way, how come this is a parse error, rather than a validation error? It could be useful to be able to disable such checks using --no-validation.