Incorrect implementations of unreachable `ref.as_non_null` validation

V8, SpiderMonkey, and JavaScriptCore all say this invalid module is valid:

(module
  (func $invalid
    (local $i32 i32)
    (unreachable)
    (ref.as_non_null)
    (local.set $i32)
  )
)

I guess production engines never bothered to implement (ref ⊥), so they just have the ref.as_non_null push ⊥ in this situation. The reference interpreter and wasm-tools get this right. WABT gets this wrong. Binaryen doesn't even try to validate unreachable code correctly.

We should probably add a spec test for this, but OTOH that would be really annoying for the engines for no real benefit.

Maybe it's time to revisit the relaxed dead code validation proposal 🤔

cc @conrad-watt

Start by reproducing the invalid module with the reference interpreter and wasm-tools, then compare their behavior with WABT, Binaryen, and the reported engines. Read the relaxed dead code validation proposal and determine whether the expected validation rule and a spec test have been agreed; done means a recorded decision and corresponding test or follow-up.