Fix a fuzz bug in TypeMapper (#5851)

TypeMapper is a utility used to globally rewrite types, mapping some eliminated
source types into destination types they should be replaced with. This was
previously done by first rewriting all the types in the IR according to the
given mapping, then rewriting the type definitions and updating all the types in
the IR again. Not only was doing the rewriting twice inefficient, it also
introduced a subtle bug where the set of private types eligible to be rewritten
could be inconsistent because updating types in the IR could change the types of
control flow structures. The fuzzer found a case where this inconsistency caused
the type rebuilding to fail.

Fix the bug by first building the new types with the mapping applied and only
then rewriting the IR a single time.

Also add a `TypeBuilder::dump` utility for use in debugging.

Fixes #5845.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/wasm-type.h b/src/wasm-type.h
index 323ef0207..580c198e3 100644
--- a/src/wasm-type.h
+++ b/src/wasm-type.h
@@ -655,6 +655,8 @@ struct TypeBuilder {
   };
 
   Entry operator[](size_t i) { return Entry{*this, i}; }
+
+  void dump();
 };
 
 std::ostream& operator<<(std::ostream&, Type);