Fuzzer: Fix subtyping of bottom types when fuzzing against JS (WebAssembly#8683)

maybeRefine should refine between old and new, and we were missing
a check for being refined enough when traversing all subtypes of bottom.
As a result, we could un-refine, which can break if a call exists.

Author: kripken

src/tools/fuzzing/fuzzing.cpp

@@ -2470,9 +2470,9 @@ void TranslateToFuzzReader::mutateJSBoundary() {
       options.push_back(newHeapType);
       // We cannot look at a bottom type's supers (there can be many, and the
       // getSuperType() API doesn't return them), but can use
-      // interestingHeapSubTypes on the top.
+      // interestingHeapSubTypes: any subtype of old is valid.
       if (newHeapType.isBottom()) {
-        for (auto type : interestingHeapSubTypes[newHeapType.getTop()]) {
+        for (auto type : interestingHeapSubTypes[oldHeapType]) {
           options.push_back(type);
         }
         break;