Unsubtyping fuzz bug on continuations

[kripken]

(module
 (rec
  (type $1 (sub (shared (func (result f32)))))
  (type $2 (sub $1 (shared (func (result f32)))))
  (type $3 (sub $2 (shared (func (result f32)))))
  (type $5 (sub (shared (func (param (ref $3) (ref null $1) i64 f64) (result (ref null $15))))))
  (type $37 (func (param (ref null $11) (ref $11) (ref null $15) (ref eq)) (result (ref $2))))
  (type $18 (array i8))
  (type $11 (sub (cont $12)))
  (type $38 (cont $33))
  (type $15 (sub (cont $12)))
  (type $33 (func (param (ref null $5) (ref $15)) (result (ref null $2))))
  (type $12 (sub (func (param (ref null $5)) (result (ref null $2)))))
 )
 (table $0 112 funcref)
 (elem declare func $186 $4)
 (@binaryen.js.called)
 (func $4 (type $12) (param $0 (ref null $5)) (result (ref null $2))
  (unreachable)
 )
 (func $186 (type $33) (param $0 (ref null $5)) (param $1 (ref $15)) (result (ref null $2))
  (unreachable)
 )
 (func $187 (type $12) (param $0 (ref null $5)) (result (ref null $2))
  (local $1 (ref null $15))
  (call_indirect $0 (type $37)
   (cont.bind $38 $11
    (cont.new $15
     (ref.func $4)
    )
    (cont.new $38
     (ref.func $186)
    )
   )
   (cont.new $11
    (ref.func $4)
   )
   (local.get $1)
   (array.new_fixed $18 0)
   (i32.const 0)
  )
 )
)

$ bin/wasm-opt w.wat -all --unsubtyping --closed-world
wasm-opt: src/passes/Unsubtyping.cpp:929: void wasm::{anonymous}::Unsubtyping::processSubtype(wasm::HeapType, wasm::HeapType): Assertion `HeapType::isSubType(sub, super)' failed.
Aborted                    (core dumped) bin/wasm-opt w.wat -all --unsubtyping --closed-world

cc @tlively

[kripken]

Specifically I am not sure if we are missing validation here, or if this is a bug in the pass.

[tlively]

We're missing so much stack switching validation that I would just not bother fuzzing it for the time being. I should have a PR up to fix it tomorrow.