gc_fuzz: Subtype values satisfy required supertypes.

[khagankhan]

Small updates before cast support

types.rs:
Added subtype-aware matching in StackType::fixup for typed struct operands. A stack value of subtype S can now satisfy a required supertype T by walking the existing supertype chain in Types, instead of requiring exact type-index equality with actual <: wanted

mutator.rs:
add_struct now creates a rec group first when none exist, instead of failing to add a struct. This increases the chance of mutating toward struct/rec-group state rather than toward simpler table-only ops.

tests.rs:
New tests for new function and StackType::fixup(...)

+cc @fitzgen @eeide

[github-actions]

Subscribe to Label Action

cc @fitzgen

Details

This issue or pull request has been labeled: "fuzzing"

Thus the following users have been cc'd because of the following labels:

• fitzgen: fuzzing

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

[fitzgen]

Nice

[khagankhan]

I am looking at the failure...

[khagankhan]

The bug was in is_subtype_index, it mapped dense type indices (0, 1, 2, ...) to TypeIds with self.type_defs.keys().nth(i), which follows BTreeMap key order. But I forgot that we sort them before encoding to wasm module (subtypes).

The new test is_subtype_index_encoding_order_differs_from_key_order covers exactly this case.

The fix is to handle this in Types::fixup() by computing and passing correct encoding order there, instead of relying on StackType::fixup() to reconstruct it. I think this is better for two reasons:

1. This is fundamentally a fixup-time correctness issue, not something that should live in to_wasm_binary().
2. It avoids recomputing the encoding order multiple times. Previously, we would effectively derive the same ordering once during binary emission and again during stack fixup. Now it is computed once during fixup and reused where needed.

As part of this change, the tests were updated accordingly.

This also allowed fn type_to_group_map(...) to be computed once and passed through the fixup path, instead of calling it twice in breaking cycles and sorting.