Throw out fewer fuzz inputs with differential fuzzer (#4859)

* Throw out fewer fuzz inputs with differential fuzzer

Prior to this commit the differential fuzzer would generate a module and
then select an engine to execute the module against Wasmtime. This
meant, however, that the candidate list of engines were filtered against
the configuration used to generate the module to ensure that the
selected engine could run the generated module.

This commit inverts this logic and instead selects an engine first,
allowing the engine to then tweak the module configuration to ensure
that the generated module is compatible with the engine selected. This
means that fewer fuzz inputs are discarded because every fuzz input will
result in an engine being executed.

Internally the engine constructors have all been updated to update the
configuration to work instead of filtering the configuration. Some other
fixes were applied for the spec interpreter as well to work around #4852

* Fix tests

crates/fuzzing/src/oracles/diff_v8.rs

@@ -1,4 +1,4 @@
-use crate::generators::{DiffValue, DiffValueType, ModuleConfig};
+use crate::generators::{Config, DiffValue, DiffValueType};
 use crate::oracles::engine::{DiffEngine, DiffInstance};
 use anyhow::{bail, Error, Result};
 use std::cell::RefCell;
@@ -12,7 +12,7 @@ pub struct V8Engine {
 }
 
 impl V8Engine {
-    pub fn new(config: &ModuleConfig) -> Result<V8Engine> {
+    pub fn new(config: &mut Config) -> V8Engine {
         static INIT: Once = Once::new();
 
         INIT.call_once(|| {
@@ -21,27 +21,22 @@ impl V8Engine {
             v8::V8::initialize();
         });
 
+        let config = &mut config.module_config.config;
         // FIXME: reference types are disabled for now as we seemingly keep finding
         // a segfault in v8. This is found relatively quickly locally and keeps
         // getting found by oss-fuzz and currently we don't think that there's
         // really much we can do about it. For the time being disable reference
         // types entirely. An example bug is
         // https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45662
-        if config.config.reference_types_enabled {
-            bail!("reference types are buggy in v8");
-        }
+        config.reference_types_enabled = false;
 
-        if config.config.memory64_enabled {
-            bail!("memory64 not enabled by default in v8");
-        }
+        config.min_memories = config.min_memories.min(1);
+        config.max_memories = config.max_memories.min(1);
+        config.memory64_enabled = false;
 
-        if config.config.max_memories > 1 {
-            bail!("multi-memory not enabled by default in v8");
-        }
-
-        Ok(Self {
+        Self {
             isolate: Rc::new(RefCell::new(v8::Isolate::new(Default::default()))),
-        })
+        }
     }
 }
 
@@ -325,5 +320,5 @@ fn get_diff_value(
 
 #[test]
 fn smoke() {
-    crate::oracles::engine::smoke_test_engine(|config| V8Engine::new(&config.module_config))
+    crate::oracles::engine::smoke_test_engine(|_, config| Ok(V8Engine::new(config)))
 }