`mutate` fuzzer assertion failure (v2)

Using [clusterfuzz-testcase-minimized-wasm-tools-mutate-5491469354139648.gz](https://github.com/bytecodealliance/wasm-tools/files/10135901/clusterfuzz-testcase-minimized-wasm-tools-mutate-5491469354139648.gz) as input at e5ffae8f4d30ba7e25922209268d31dc18bcedfd the `mutate` fuzzer fails with:

```
$ RUST_LOG=mutate,wasm_to RUSTFLAGS=-Zgcc-ld=lld cargo +nightly fuzz run --dev --features wasmtime mutate ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-5491469354139648
Finished dev [unoptimized + debuginfo] target(s) in 0.10s
Finished dev [unoptimized + debuginfo] target(s) in 0.09s
Running `target/aarch64-unknown-linux-gnu/debug/mutate -artifact_prefix=/home/acrichto/code/wasm-tools/fuzz/artifacts/mutate/ ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-5491469354139648`
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 51222123
INFO: Loaded 1 modules (2196307 inline 8-bit counters): 2196307 [0xaaaacfcf5160, 0xaaaacff0d4b3),
INFO: Loaded 1 PC tables (2196307 PCs): 2196307 [0xaaaacff0d4b8,0xaaaad20909e8),
target/aarch64-unknown-linux-gnu/debug/mutate: Running 1 inputs 1 time(s) each.
Running: ../wasmtime/clusterfuzz-testcase-minimized-wasm-tools-mutate-5491469354139648
[2022-12-01T20:15:13Z DEBUG wasm_tools_fuzz] ensuring termination with 100 fuel
[2022-12-01T20:15:13Z DEBUG wasm_tools_fuzz] writing test case to `test.wasm` ...
[2022-12-01T20:15:13Z DEBUG wasm_tools_fuzz] writing text format to `test.wat` ...
[2022-12-01T20:15:13Z DEBUG mutate] seed = 749124112972933479
[2022-12-01T20:15:13Z DEBUG mutate] writing mutated Wasm to `mutated.wasm`
[2022-12-01T20:15:14Z DEBUG mutate] writing mutated WAT to `mutated.wat`
[2022-12-01T20:15:17Z DEBUG mutate::eval] invoking `le
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%Beginfile
%%BeginfiZBpbmZvQHdvbG2czZwuY29I/JH4pU`
[2022-12-01T20:15:17Z DEBUG mutate::eval] consumed 0 fuel
[2022-12-01T20:15:17Z DEBUG mutate::eval] invoking `----BEGIN CERTIFICATE-----
MIIBqjCCAaSgAwIBAgIDXWJ1MBMGEaBUC0AzMV6OKweDBAA7AKOQMIAwCwYDMIAwFDAPBgkqhkiG9w0BAQEDBAAwAKOAMIAwCwYDVR0kBA0wAYCEaSgAwIBDIgAXWJ2MBMGEaBUC0AzMV6OKweDBAA7AKOQMIAwCwYDMIAwFDAPBgkqhkiG9w0BAQEDBAAwAKOAMIAwCwYDVR0kBA0wAYDVR0jBAMwwgzYBytMR6wHQ`
[2022-12-01T20:15:17Z DEBUG mutate::eval] consumed 0 fuel
[2022-12-01T20:15:17Z DEBUG mutate::eval] invoking `5`
[2022-12-01T20:15:17Z DEBUG mutate::eval] consumed 344 fuel
thread '' panicked at 'assertion failed: o == m || (o.is_nan() && m.is_nan())', fuzz/fuzz_targets/mutate.rs:276:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==2728396== ERROR: libFuzzer: deadly signal
LLVMSymbolizer: error reading file: No such file or directory
#0 0xaaaac3e52ecc in __sanitizer_print_stack_trace /checkout/src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
#1 0xaaaacf513718 in fuzzer::PrintStackTrace() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerUtil.cpp:210:38
#2 0xaaaacf4bfb10 in fuzzer::Fuzzer::CrashCallback() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:233:18
#3 0xaaaacf4bf95c in fuzzer::Fuzzer::StaticCrashSignalCallback() /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:204:19
#4 0xaaaacf4edfd0 in fuzzer::CrashHandler(int, siginfo_t*, void*) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerUtilPosix.cpp:46:36
#5 0xffff8950f7bc (linux-vdso.so.1+0x7bc) (BuildId: c8964b2dae912af5589964720a9e9dec13faf142)
#6 0xffff890a3ea8 in __libc_signal_restore_set signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3
#7 0xffff890a3ea8 in raise signal/../sysdeps/unix/sysv/linux/raise.c:48:3
#8 0xffff89090a9c in abort stdlib/abort.c:79:7
#9 0xaaaacf649e64 in std::sys::unix::abort_internal::hb33125e81b7e705c /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/sys/unix/mod.rs:347:14
#10 0xaaaacf639d28 in std::process::abort::ha43dd1d198ccc5d7 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/process.rs:2119:5
#11 0xaaaacf4aebb0 in libfuzzer_sys::initialize::_$u7b$$u7b$closure$u7d$$u7d$::h2d6aa4788b283c7c /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:91:9
#12 0xaaaacf63fa50 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h878b2307ac09927c /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/alloc/src/boxed.rs:2032:9
#13 0xaaaacf63fa50 in std::panicking::rust_panic_with_hook::hed964c2d9564a3f6 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:692:13
#14 0xaaaacf63f7cc in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hcb585d1de87181f1 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:577:13
#15 0xaaaacf63cec8 in std::sys_common::backtrace::__rust_end_short_backtrace::h055898b310cca970 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/sys_common/backtrace.rs:137:18
#16 0xaaaacf63f550 in rust_begin_unwind /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:575:5
#17 0xaaaacf694708 in core::panicking::panic_fmt::h228a34964b8b08d7 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/core/src/panicking.rs:65:14
#18 0xaaaacf69479c in core::panicking::panic::hdf0bcc8ccc321bd6 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/core/src/panicking.rs:114:5
#19 0xaaaac3ee1510 in mutate::eval::assert_val_eq::h82a41fe6fffa03b4 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:276:17
#20 0xaaaac3eded0c in mutate::eval::assert_same_calls::h5165eb14b1723a57 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:257:25
#21 0xaaaac3ed91f4 in mutate::eval::assert_same_evaluation::h31a948328799339f /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:172:9
#22 0xaaaac3f6dc60 in mutate::_::run::h935eca3f16a59e36 /home/acrichto/code/wasm-tools/fuzz/fuzz_targets/mutate.rs:112:13
#23 0xaaaac3f6751c in rust_fuzzer_test_input /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:224:17
#24 0xaaaacf4ad958 in libfuzzer_sys::test_input_wrap::_$u7b$$u7b$closure$u7d$$u7d$::hf41bb3de48e9d94c /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:61:9
#25 0xaaaacf4b5754 in std::panicking::try::do_call::h02b787ff3583d87a /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:483:40
#26 0xaaaacf4b5fd0 in __rust_try libfuzzer_sys.5272392d-cgu.3
#27 0xaaaacf4b4cec in std::panicking::try::hd01b1a80017b41c6 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panicking.rs:447:19
#28 0xaaaacf4af3f8 in std::panic::catch_unwind::hf1bb065beea8da71 /rustc/e9493d63c2a57b91556dccd219e21821432c7445/library/std/src/panic.rs:137:14
#29 0xaaaacf4acd70 in LLVMFuzzerTestOneInput /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/src/lib.rs:59:22
#30 0xaaaacf4c1778 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerLoop.cpp:612:15
#31 0xaaaacf4e1758 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerDriver.cpp:324:21
#32 0xaaaacf4e4cc0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerDriver.cpp:860:19
#33 0xaaaacf5123b8 in main /home/acrichto/.cargo/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.5/libfuzzer/FuzzerMain.cpp:20:30
#34 0xffff89090e14 in __libc_start_main csu/../csu/libc-start.c:308:16
#35 0xaaaac3dbcfd0 in _start (/home/acrichto/code/wasm-tools/target/aarch64-unknown-linux-gnu/debug/mutate+0x45acfd0) (BuildId: 15a4800a87135d1c)

NOTE: libFuzzer has rudimentary signal handlers.
Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
────────────────────────────────────────────────────────────────────────────────

Error: Fuzz target exited with exit status: 77
```