Fix comparison of none and unreachable types (#2514)

Currently `none` and `unreachable` types are stored as the same empty
`{}` in src/wasm/wasm-type.cpp. This makes `Type::operator<` incorrectly
when given `none` and `unreachable`, because it expands both given types
and lexicographically compare them, when both of the expanded vector
will be empty.

This was found by the fuzzer. This line in `Modder::visitExpression`
tries to retrieve candidates of the same type. Because we can't really
compare these two types, if you give `unreachable` as the key,
candidates of `none` type can be returned. This generates incorrect code
that ends up failing in validation in a very weird way.

It was hard to generate a small testcase to trigger this part because it
was found by generating fuzzed code from a random data file. But I guess
this fix is pretty straightforward.

Fixes #2512.

Author: aheejin

src/wasm/wasm-type.cpp

@@ -56,7 +56,7 @@ std::vector<std::unique_ptr<std::vector<Type>>> typeLists = [] {
   };
 
   add({});
-  add({});
+  add({Type::unreachable});
   add({Type::i32});
   add({Type::i64});
   add({Type::f32});
@@ -69,7 +69,7 @@ std::vector<std::unique_ptr<std::vector<Type>>> typeLists = [] {
 
 std::unordered_map<std::vector<Type>, uint32_t> indices = {
   {{}, Type::none},
-  {{}, Type::unreachable},
+  {{Type::unreachable}, Type::unreachable},
   {{Type::i32}, Type::i32},
   {{Type::i64}, Type::i64},
   {{Type::f32}, Type::f32},

test/binaryen.js/kitchen-sink.js.txt

@@ -1,7 +1,7 @@
   // BinaryenTypeNone: 0
   // []
   // BinaryenTypeUnreachable: 1
-  // []
+  // [ 1 ]
   // BinaryenTypeInt32: 2
   // [ 2 ]
   // BinaryenTypeInt64: 3
@@ -10106,7 +10106,7 @@ optimized:
   // BinaryenTypeNone: 0
   // []
   // BinaryenTypeUnreachable: 1
-  // []
+  // [ 1 ]
   // BinaryenTypeInt32: 2
   // [ 2 ]
   // BinaryenTypeInt64: 3

test/example/c-api-kitchen-sink.c

@@ -159,9 +159,9 @@ void test_types() {
 
   BinaryenType unreachable = BinaryenTypeUnreachable();
   printf("  // BinaryenTypeUnreachable: %d\n", unreachable);
-  assert(BinaryenTypeArity(unreachable) == 0);
+  assert(BinaryenTypeArity(unreachable) == 1);
   BinaryenTypeExpand(unreachable, &valueType);
-  assert(valueType == 0xdeadbeef);
+  assert(valueType == unreachable);
 
   BinaryenType i32 = BinaryenTypeInt32();
   printf("  // BinaryenTypeInt32: %d\n", i32);