[Wasm GC] Validate static subtyping in rtt.sub (#3696)

Also add more spec tests, including one that verifies we validate
rtt.sub and on a global location as fixed by #3694

1 files changed, 3 insertions, 0 deletions

diff --git a/src/wasm/wasm-validator.cpp b/src/wasm/wasm-validator.cpp
index a057f34b9..c7423ad6d 100644
--- a/src/wasm/wasm-validator.cpp
+++ b/src/wasm/wasm-validator.cpp
@@ -2261,6 +2261,9 @@ void FunctionValidator::visitRttSub(RttSub* curr) {
                     curr,
                     "rtt.canon has a depth of 1 over the parent");
     }
+    shouldBeTrue(HeapType::isSubType(rtt.heapType, parentRtt.heapType),
+                 curr,
+                 "rtt.sub parent must be a supertype");
   }
 }