`mutate` fuzzer assertion failure

Using [clusterfuzz-testcase-minimized-wasm-tools-mutate-4980250201423872.gz](https://github.com/bytecodealliance/wasm-tools/files/10127774/clusterfuzz-testcase-minimized-wasm-tools-mutate-4980250201423872.gz) as input at e5ffae8f4d30ba7e25922209268d31dc18bcedfd the `mutate` fuzzer fails with:

```
$ RUST_LOG=mutate,wasm_to RUSTFLAGS=-Zgcc-ld=lld cargo +nightly fuzz run --dev --features wasmtime mutate ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-4980250201423872
Finished dev [unoptimized + debuginfo] target(s) in 0.10s
Finished dev [unoptimized + debuginfo] target(s) in 0.09s
Running `target/aarch64-unknown-linux-gnu/debug/mutate -artifact_prefix=/home/acrichto/code/wasm-tools/fuzz/artifacts/mutate/ ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-4980250201423872`
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3016238139
INFO: Loaded 1 modules (2196307 inline 8-bit counters): 2196307 [0xaaaad5dc5160, 0xaaaad5fdd4b3),
INFO: Loaded 1 PC tables (2196307 PCs): 2196307 [0xaaaad5fdd4b8,0xaaaad81609e8),
target/aarch64-unknown-linux-gnu/debug/mutate: Running 1 inputs 1 time(s) each.
Running: ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-4980250201423872
[2022-11-30T22:36:43Z DEBUG wasm_tools_fuzz] writing test case to `test.wasm` ...
[2022-11-30T22:36:43Z DEBUG wasm_tools_fuzz] writing text format to `test.wat` ...
[2022-11-30T22:36:43Z DEBUG mutate] seed = 1085102592571150095
[2022-11-30T22:36:44Z DEBUG mutate] writing mutated Wasm to `mutated.wasm`
[2022-11-30T22:36:44Z DEBUG mutate] writing mutated WAT to `mutated.wat`
[2022-11-30T22:36:45Z DEBUG mutate::eval] invoking `1-re`
[2022-11-30T22:36:45Z DEBUG mutate::eval] consumed 0 fuel
[2022-11-30T22:36:45Z DEBUG mutate::eval] invoking `a!%ea%aD%aa!%ea%aD%aa!%ea%aD%aa!%ea%aD%aa!%ea%aD%a!!%ea%aD%a`
[2022-11-30T22:36:45Z DEBUG mutate::eval] consumed 0 fuel
thread '' panicked at 'assertion failed: `(left == right)`
left: `252645135`,
right: `625238309`', fuzz/fuzz_targets/mutate.rs:271:63
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==2475455== ERROR: libFuzzer: deadly signal
LLVMSymbolizer: error reading file: No such file or directory
#0 0xaaaac9f22ecc in __sanitizer_print_stack_trace /checkout/src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
#1 0xaaaad55e3718 in fuzzer::PrintStackTrace() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerUtil.cpp:210:38
#2 0xaaaad558fb10 in fuzzer::Fuzzer::CrashCallback() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:233:18
#3 0xaaaad558f95c in fuzzer::Fuzzer::StaticCrashSignalCallback() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:204:19
#4 0xaaaad55bdfd0 in fuzzer::CrashHandler(int, siginfo_t*, void*) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerUtilPosix.cpp:46:36
#5 0xffff89d1e7bc (linux-vdso.so.1+0x7bc) (BuildId: c8964b2dae912af5589964720a9e9dec13faf142)
#6 0xffff898b2ea8 in __libc_signal_restore_set signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3
#7 0xffff898b2ea8 in raise signal/../sysdeps/unix/sysv/linux/raise.c:48:3
#8 0xffff8989fa9c in abort stdlib/abort.c:79:7
#9 0xaaaad5719e64 in std::sys::unix::abort_internal::hb33125e81b7e705c /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/sys/unix/mod.rs:347:14
#10 0xaaaad5709d28 in std::process::abort::ha43dd1d198ccc5d7 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/process.rs:2119:5
#11 0xaaaad557ebb0 in libfuzzer_sys::initialize::_$u7b$$u7b$closure$u7d$$u7d$::h2d6aa4788b283c7c /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:91:9
#12 0xaaaad570fa50 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h878b2307ac09927c /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/alloc/src/boxed.rs:2032:9
#13 0xaaaad570fa50 in std::panicking::rust_panic_with_hook::hed964c2d9564a3f6 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:692:13
#14 0xaaaad570f80c in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hcb585d1de87181f1 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:579:13
#15 0xaaaad570cec8 in std::sys_common::backtrace::__rust_end_short_backtrace::h055898b310cca970 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/sys_common/backtrace.rs:137:18
#16 0xaaaad570f550 in rust_begin_unwind /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:575:5
#17 0xaaaad5764708 in core::panicking::panic_fmt::h228a34964b8b08d7 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/core/src/panicking.rs:65:14
#18 0xaaaad5764a78 in core::panicking::assert_failed_inner::h34c118d06a2b2b65 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/core/src/panicking.rs
#19 0xaaaaca01ae00 in core::panicking::assert_failed::h7530a03bb7268ac9 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/core/src/panicking.rs:201:5
#20 0xaaaac9fb1e44 in mutate::eval::assert_val_eq::h82a41fe6fffa03b4 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:271:63
#21 0xaaaac9faae50 in mutate::eval::assert_same_state::h51226ac0235b8143 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:197:21
#22 0xaaaac9fa9224 in mutate::eval::assert_same_evaluation::h31a948328799339f /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:173:9
#23 0xaaaaca03dc60 in mutate::_::run::h935eca3f16a59e36 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:112:13
#24 0xaaaaca03751c in rust_fuzzer_test_input /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:224:17
#25 0xaaaad557d958 in libfuzzer_sys::test_input_wrap::_$u7b$$u7b$closure$u7d$$u7d$::hf41bb3de48e9d94c /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:61:9
#26 0xaaaad5585754 in std::panicking::try::do_call::h02b787ff3583d87a /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:483:40
#27 0xaaaad5585fd0 in __rust_try libfuzzer_sys.5272392d-cgu.3
#28 0xaaaad5584cec in std::panicking::try::hd01b1a80017b41c6 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:447:19
#29 0xaaaad557f3f8 in std::panic::catch_unwind::hf1bb065beea8da71 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panic.rs:137:14
#30 0xaaaad557cd70 in LLVMFuzzerTestOneInput /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:59:22
#31 0xaaaad5591778 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:612:15
#32 0xaaaad55b1758 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerDriver.cpp:324:21
#33 0xaaaad55b4cc0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerDriver.cpp:860:19
#34 0xaaaad55e23b8 in main /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerMain.cpp:20:30
#35 0xffff8989fe14 in __libc_start_main csu/../csu/libc-start.c:308:16
#36 0xaaaac9e8cfd0 in _start (/home/acrichto/code/wasm-tools/target/aarch64-unknown-linux-gnu/debug/mutate+0x45acfd0) (BuildId: 15a4800a87135d1c)

NOTE: libFuzzer has rudimentary signal handlers.
Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
────────────────────────────────────────────────────────────────────────────────

Error: Fuzz target exited with exit status: 77
```