CALL_INDIRECT resolves caller type indices against the referenced function's module

[hidekatsu-izuno]

Summary

CALL_INDIRECT resolves the caller’s type index using the module that owns the table function. Type indices are module-local, so this fails for functions from another module in a shared table (unknown type 21).

Fix

In CALL_INDIRECT and RETURN_CALL_INDIRECT:

var refInstance = requireNonNullElse(table.instance(funcTableIdx), instance);
var expectedType = instance.type(typeId); 
var actualType = refInstance.type(refInstance.functionType(funcId));
verifyIndirectCall(actualType, expectedType, instance.module().typeSection());

Specification references

• Type indices are instantiated using the corresponding module instance's type vector:
  https://webassembly.github.io/spec/core/exec/types.html#instantiation
• A table holds reference values and may be populated by active element segments:
  https://webassembly.github.io/spec/core/exec/runtime.html#table-instances
• Function instances retain their originating module instance:
  https://webassembly.github.io/spec/core/exec/runtime.html#function-instances
• Function-reference invocation uses the referenced function instance's own type and module:
  https://webassembly.github.io/spec/core/exec/instructions.html#exec-invoke

[andreaTP]

Thanks for the interest in this project @hidekatsu-izuno .

Seems strange but we haven't seen a lot of real world modules linking.
I'll have a look early next week, meanwhile, if you have a reproducer it will be appreciated 🙏