Fix comparison of none and unreachable types (#2514)

Currently `none` and `unreachable` types are stored as the same empty
`{}` in src/wasm/wasm-type.cpp. This makes `Type::operator<` incorrectly
when given `none` and `unreachable`, because it expands both given types
and lexicographically compare them, when both of the expanded vector
will be empty.

This was found by the fuzzer. This line in `Modder::visitExpression`
tries to retrieve candidates of the same type. Because we can't really
compare these two types, if you give `unreachable` as the key,
candidates of `none` type can be returned. This generates incorrect code
that ends up failing in validation in a very weird way.

It was hard to generate a small testcase to trigger this part because it
was found by generating fuzzed code from a random data file. But I guess
this fix is pretty straightforward.

Fixes #2512.

1 files changed, 2 insertions, 2 deletions

diff --git a/test/example/c-api-kitchen-sink.c b/test/example/c-api-kitchen-sink.c
index f438015b8..500188a55 100644
--- a/test/example/c-api-kitchen-sink.c
+++ b/test/example/c-api-kitchen-sink.c
@@ -159,9 +159,9 @@ void test_types() {
 
   BinaryenType unreachable = BinaryenTypeUnreachable();
   printf("  // BinaryenTypeUnreachable: %d\n", unreachable);
-  assert(BinaryenTypeArity(unreachable) == 0);
+  assert(BinaryenTypeArity(unreachable) == 1);
   BinaryenTypeExpand(unreachable, &valueType);
-  assert(valueType == 0xdeadbeef);
+  assert(valueType == unreachable);
 
   BinaryenType i32 = BinaryenTypeInt32();
   printf("  // BinaryenTypeInt32: %d\n", i32);