Fix use child typer in the validator 6613

[ArkadySkv]

Problem: FunctionValidator::visitUnary and visitBinary contain
~400 lines of per-opcode child-type checks expressed as
shouldBeEqual / shouldBeEqualOrFirstIsUnreachable calls. The
same constraints are already encoded in src/ir/child-typer.h and
consumed by the IRBuilder. The duplication is error-prone: a missed
case is a soundness hole. visitRefIsNull and visitRefEq have
the same shape at smaller scale.

Fix (Path A): Add a ValidatorTypeChecker subclass of
ChildTyper<ValidatorTypeChecker> in wasm-validator.cpp. Its
note() callback checks each child's type against the emitted
constraint via PrincipalType::matches, skipping unreachable
children. Replace the switches in visitUnary and visitBinary
with single calls. Migrate the per-child checks in
visitRefIsNull and visitRefEq.

Checks that ChildTyper does not express are kept in the
validator:

• Feature gates: FP16 on visitUnary and visitBinary; GC and
  reference-types on visitRefIsNull and visitRefEq.
• Structural: the sibling left->type == right->type check and
  the tuple-arity guard on visitBinary.
• Cross-child: the sharedness equality on visitRefEq.
  ValidatorTypeChecker calls PrincipalType::matches, which
  builds a fresh VarAssignments per child, so the
  VarSharedness variable that ChildTyper::visitRefEq emits
  does not unify across the two note() calls.

ValidatorTypeChecker gains a no-op noteUnknown(), required for
CRTP instantiation.

Verification:

git show HEAD~3:src/wasm/wasm-validator.cpp \
  | awk '/^void FunctionValidator::visitUnary/{p=1} p{print} p && /^}/{exit}' \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/val_unary.txt
sed -n '/void visitUnary(/,/^  }/p' src/ir/child-typer.h \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/ct_unary.txt
diff /tmp/val_unary.txt /tmp/ct_unary.txt

git show HEAD~2:src/wasm/wasm-validator.cpp \
  | awk '/^void FunctionValidator::visitBinary/{p=1} p{print} p && /^}/{exit}' \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/val_binary.txt
sed -n '/void visitBinary(/,/^  }/p' src/ir/child-typer.h \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/ct_binary.txt
diff /tmp/val_binary.txt /tmp/ct_binary.txt

# Coverage diffs must both be empty.
python3 check.py lit

Result: both diffs empty; check.py lit passes with 1002 tests.

New regression tests:

• test/lit/validation/binary-bad-operand.wast
• test/lit/validation/ref-is-null-bad-operand.wast
• test/lit/validation/i31-get-bad-operand.wast (locks in the
  pre-existing visitI31Get rejection message; that method is
  not migrated)

Two migrations were attempted and reverted:

1. visitI31Get. ChildTyper::visitI31Get emits the unshared
   Type(HeapType::i31, Nullable). The validator's pre-existing
   check uses shouldBeSubTypeIgnoringShared, which accepts
   (ref null (shared i31)). Migrating rejected shared i31 and
   broke basic/shared-i31.wast, passes/make-shared-objects.wast,
   and passes/unsubtyping.wast.

2. visitCallRef. ChildTyper::visitCallRef notes the target as
   Type(getSignature(), Nullable), which drops sharedness.
   Shared function references were rejected, breaking 25 lit
   tests. The IRBuilder enforces call_ref operand types at
   parse time, so the migrated check was redundant for WAT input.

Diagnostic change: per-opcode messages ("i32 op", "expected v128
operand", etc.) become "child type does not match its constraint",
reported at the failing child rather than the parent.

Follow-up: See #NNNN (ChildTyper sharedness) and #NNNN (complete
the remaining migration). The sharedness issue blocks visitI31Get
and visitCallRef; the completion issue covers the ~70 methods
with ChildTyper counterparts that remain unexamined. The SIMD
and tuple families are deliberately not migrated: their switches
are dominated by immediate validation, memory helpers, and result
type checks.

Refs #6613. Does not close it.

[tlively]

Seems promising! Can you:

1. Rewrite the description to remove extraneous detail.
2. Measure how this change affects the performance of validation.

[tlively]

Presumably if we had a utility that gave the full principal type of an expression, we wouldn't have this problem any more. Such a utility would also be useful for e.g. the Outlining pass.

[tlively]

Please add newlines at the end of the test files.