Fix use child typer in the validator 6613

[ArkadySkv]

Problem: FunctionValidator::visitUnary and visitBinary contain
~400 lines of per-opcode child-type checks. The same constraints
are already encoded in src/ir/child-typer.h and consumed by the
IRBuilder. The duplication is error-prone: a missed case is a
soundness hole. visitRefIsNull and visitRefEq have the same
shape at smaller scale.

Fix (Path A): Add a ValidatorTypeChecker subclass of
ChildTyper<ValidatorTypeChecker> in wasm-validator.cpp. Its
note() callback checks each child's type against the emitted
constraint via PrincipalType::matches, skipping unreachable
children. Replace the switches in visitUnary and visitBinary
with single calls, and migrate the per-child checks in
visitRefIsNull and visitRefEq. Feature gates, structural
checks, and the cross-child sharedness check on visitRefEq stay
in the validator, since ChildTyper does not express them.

Verification:

git show HEAD~3:src/wasm/wasm-validator.cpp \
  | awk '/^void FunctionValidator::visitUnary/{p=1} p{print} p && /^}/{exit}' \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/val_unary.txt
sed -n '/void visitUnary(/,/^  }/p' src/ir/child-typer.h \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/ct_unary.txt
diff /tmp/val_unary.txt /tmp/ct_unary.txt   # must be empty
# same for visitBinary
python3 check.py lit                          # 1002 pass

New regression tests: binary-bad-operand.wast,
ref-is-null-bad-operand.wast, i31-get-bad-operand.wast.

Two migrations were attempted and reverted, both blocked by
ChildTyper constraints that drop sharedness: visitI31Get
(constraint fixed to unshared i31; the validator uses
shouldBeSubTypeIgnoringShared) and visitCallRef (target noted
as Type(getSignature(), Nullable), which loses sharedness).
Details in #NNNN.

Follow-up: #NNNN tracks completing the remaining ~70 methods;
#NNNN tracks the sharedness incompatibility. Per @tlively's
suggestion, a utility that returns an expression's full principal
type would address both — it would let the validator reason about
sharedness directly and would also serve the Outlining pass.

validation performance.

Built base and new from the same commit (version_132-98-gd88447204) so the only difference is the PR. Corpus: 349 test/lit/passes/*.wast files that both binaries parse and validate cleanly. hyperfine --warmup 3 --runs 30:

base:  3.353 s ± 0.725 s
new:   3.371 s ± 0.623 s
base is 1.01 ± 0.29 times faster than new

The interval straddles 1.0. No measurable difference at this corpus size. The change replaces each shouldBeEqualOrFirstIsUnreachable with a ValidatorTypeChecker::note that calls PrincipalType::matches; the work per check is comparable, which matches the measurement.

If you have a larger real-world wasm you would like me to run against, happy to; the current corpus is bounded by process startup cost rather than by validation work.

Refs #6613. Does not close it.

[tlively]

Seems promising! Can you:

1. Rewrite the description to remove extraneous detail.
2. Measure how this change affects the performance of validation.

[tlively]

Presumably if we had a utility that gave the full principal type of an expression, we wouldn't have this problem any more. Such a utility would also be useful for e.g. the Outlining pass.

[tlively]

Please add newlines at the end of the test files.

[ArkadySkv]

I've done it

[ArkadySkv]

I've done it

[ArkadySkv]

Seems promising! Can you:

1. Rewrite the description to remove extraneous detail.
2. Measure how this change affects the performance of validation.

Two cases are done