Merge pull request from GHSA-5fhj-g3p3-pq9g

* Improve cranelift disassembly of stack maps

Print out extra information about stack maps such as their contents and
other related metadata available. Additionally also print out addresses
in hex to line up with the disassembly otherwise printed as well.

* Improve the `table_ops` fuzzer

* Generate more instructions by default
* Fix negative indices appearing in `table.{get,set}`
* Assert that the traps generated are expected to prevent accidental
  other errors reporting a fuzzing success.

* Fix `reftype_vregs` reported to `regalloc2`

This fixes a mistake in the register allocation of Cranelift functions
where functions using reference-typed arguments incorrectly report which
virtual registers are reference-typed values if there are vreg aliases
in play. The fix here is to apply the vreg aliases to the final list of
reftyped regs which is eventually passed to `regalloc2`.

The main consequence of this fix is that functions which previously
accidentally didn't have correct stack maps should now have the missing
stack maps.

* Add a test that `table_ops` gc's eventually

* Add a comment about new alias resolution

* Update crates/fuzzing/src/oracles.rs

Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>

* Add some comments

Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>

crates/fuzzing/src/oracles.rs

@@ -541,10 +541,17 @@ pub fn spectest(mut fuzz_config: generators::Config, test: generators::SpecTest)
 }
 
 /// Execute a series of `table.get` and `table.set` operations.
-pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops::TableOps) {
+///
+/// Returns the number of `gc` operations which occurred throughout the test
+/// case -- used to test below that gc happens reasonably soon and eventually.
+pub fn table_ops(
+    mut fuzz_config: generators::Config,
+    ops: generators::table_ops::TableOps,
+) -> usize {
     let expected_drops = Arc::new(AtomicUsize::new(ops.num_params as usize));
     let num_dropped = Arc::new(AtomicUsize::new(0));
 
+    let num_gcs = Arc::new(AtomicUsize::new(0));
     {
         fuzz_config.wasmtime.consume_fuel = true;
         let mut store = fuzz_config.to_store();
@@ -554,7 +561,7 @@ pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops
         log_wasm(&wasm);
         let module = match compile_module(store.engine(), &wasm, false, &fuzz_config) {
             Some(m) => m,
-            None => return,
+            None => return 0,
         };
 
         let mut linker = Linker::new(store.engine());
@@ -563,7 +570,6 @@ pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops
         // test case.
         const MAX_GCS: usize = 5;
 
-        let num_gcs = AtomicUsize::new(0);
         linker
             .define(
                 "",
@@ -580,6 +586,7 @@ pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops
                     {
                         let num_dropped = num_dropped.clone();
                         let expected_drops = expected_drops.clone();
+                        let num_gcs = num_gcs.clone();
                         move |mut caller: Caller<'_, StoreLimits>, _params, results| {
                             log::info!("table_ops: GC");
                             if num_gcs.fetch_add(1, SeqCst) < MAX_GCS {
@@ -663,14 +670,33 @@ pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops
         let args: Vec<_> = (0..ops.num_params)
             .map(|_| Val::ExternRef(Some(ExternRef::new(CountDrops(num_dropped.clone())))))
             .collect();
-        let _ = run.call(&mut store, &args, &mut []);
+
+        // The generated function should always return a trap. The only two
+        // valid traps are table-out-of-bounds which happens through `table.get`
+        // and `table.set` generated or an out-of-fuel trap. Otherwise any other
+        // error is unexpected and should fail fuzzing.
+        let trap = run
+            .call(&mut store, &args, &mut [])
+            .unwrap_err()
+            .downcast::<Trap>()
+            .unwrap();
+
+        match trap.trap_code() {
+            Some(TrapCode::TableOutOfBounds) => {}
+            None if trap
+                .to_string()
+                .contains("all fuel consumed by WebAssembly") => {}
+            _ => {
+                panic!("unexpected trap: {}", trap);
+            }
+        }
 
         // Do a final GC after running the Wasm.
         store.gc();
     }
 
     assert_eq!(num_dropped.load(SeqCst), expected_drops.load(SeqCst));
-    return;
+    return num_gcs.load(SeqCst);
 
     struct CountDrops(Arc<AtomicUsize>);
 
@@ -681,6 +707,32 @@ pub fn table_ops(mut fuzz_config: generators::Config, ops: generators::table_ops
     }
 }
 
+// Test that the `table_ops` fuzzer eventually runs the gc function in the host.
+// We've historically had issues where this fuzzer accidentally wasn't fuzzing
+// anything for a long time so this is an attempt to prevent that from happening
+// again.
+#[test]
+fn table_ops_eventually_gcs() {
+    use arbitrary::Unstructured;
+    use rand::prelude::*;
+
+    let mut rng = SmallRng::seed_from_u64(0);
+    let mut buf = vec![0; 2048];
+    let n = 100;
+    for _ in 0..n {
+        rng.fill_bytes(&mut buf);
+        let u = Unstructured::new(&buf);
+
+        if let Ok((config, test)) = Arbitrary::arbitrary_take_rest(u) {
+            if table_ops(config, test) > 0 {
+                return;
+            }
+        }
+    }
+
+    panic!("after {n} runs nothing ever gc'd, something is probably wrong");
+}
+
 /// Perform differential execution between Cranelift and wasmi, diffing the
 /// resulting memory image when execution terminates. This relies on the
 /// module-under-test to be instrumented to bound the execution time. Invoke