Do not pop from the polymorphic stack (was: Parse expection on unreachable struct.set)

リンクされた stubbed.wasm.gz モジュールと問題のシーケンス unreachable, global.get 43, ref.cast, struct.set $context 5 を使って失敗を再現します。unreachable の後にパーサーが多相スタックをどのように処理するかを追跡します。完了の条件は、報告された parse exception なしに、すべての有効なコンテキストでそのシーケンスが受け入れられることです。

When processing this module using https://github.com/WebAssembly/binaryen/commit/a4ab1c7ee7376977ca09e2d3c4358893e9fdfce2, I get the following error:

[parse exception: bad heap type: expected (struct (field (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...1) (mut i64) (mut (ref null (struct (field (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i64))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref) (result (ref null (struct (field (mut i32))))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref (ref null (struct (field (mut i32)))) (ref null (struct (field (mut i32))))) (result (ref null (struct (field (mut i32))))))))))) (mut ...3) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) ..!)))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut i64) (mut i32) (mut ..!) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32))))) (mut i64) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32))) but found (ref (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32)))))))) (at 0:259577)]
Fatal: error parsing wasm

The offending instruction sequence is:

(unreachable)
(global.get 43)
(ref.cast)
(struct.set $context 5)

Due to the unreachable, this sequence should be valid in all contexts, since it is valid if it would be valid for any stack contents. V8 accepts the code.

I tried to construct a smaller example, but my simpler cases did not trigger the error. I stubbed all other functions in the module to cut down on the size a bit.

By the way, how come this is a parse error, rather than a validation error? It could be useful to be able to disable such checks using --no-validation.