Do not pop from the polymorphic stack (was: Parse expection on unreachable struct.set)

Tái hiện lỗi với module stubbed.wasm.gz được liên kết và chuỗi gây lỗi: unreachable, global.get 43, ref.cast, struct.set $context 5. Theo dõi cách quá trình phân tích cú pháp xử lý stack đa hình sau unreachable; hoàn thành khi chuỗi này được chấp nhận trong mọi context hợp lệ mà không xuất hiện parse exception đã nêu.

When processing this module using https://github.com/WebAssembly/binaryen/commit/a4ab1c7ee7376977ca09e2d3c4358893e9fdfce2, I get the following error:

[parse exception: bad heap type: expected (struct (field (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...1) (mut i64) (mut (ref null (struct (field (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i64))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref) (result (ref null (struct (field (mut i32))))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) (ref (func (param dataref (ref null (struct (field (mut i32)))) (ref null (struct (field (mut i32))))) (result (ref null (struct (field (mut i32))))))))))) (mut ...3) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32) (mut i64) (mut i64) (mut (ref null (struct (field (mut i32) (mut i32) (mut ...3) (mut ...1) (mut ...1))))))))) (mut i32) (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32))))) (mut (ref null (struct (field (mut i32) (mut i32) (mut dataref) ..!)))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32))))) (mut i64) (mut i32) (mut ..!) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32))))) (mut i64) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut i32) (mut i32) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut i32))))) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut i32) (mut i32) (mut ..!))))) (mut ..!) (mut ..!) (mut ..!) (mut i32) (mut ..!) (mut ..!) (mut ..!) (mut i32))) but found (ref (struct (field (mut i32) (mut i32) (mut (ref null (struct (field (mut i32) (mut i32)))))))) (at 0:259577)]
Fatal: error parsing wasm

The offending instruction sequence is:

(unreachable)
(global.get 43)
(ref.cast)
(struct.set $context 5)

Due to the unreachable, this sequence should be valid in all contexts, since it is valid if it would be valid for any stack contents. V8 accepts the code.

I tried to construct a smaller example, but my simpler cases did not trigger the error. I stubbed all other functions in the module to cut down on the size a bit.

By the way, how come this is a parse error, rather than a validation error? It could be useful to be able to disable such checks using --no-validation.