weird bug with exception handling (interpreter)

[SoniEx2]

hey @takikawa (noticed you wrote exception handling support for the interpreter) would you have any idea why this test: https://github.com/WebAssembly/exception-handling/pull/332

(module
  (tag $e0)
  (func $longjmp-bait (throw $e0))
  (func (export "setjmp-bait") (param $return-early i32) (result i32)
    (local $value i32)
    (try $try
      (do
        (br_if $try (local.get $return-early))
        (local.set $value (i32.const 1))
        (call $longjmp-bait)
      )
      (catch $e0)
    )
    (local.get $value)
  )
)

(assert_return (invoke "setjmp-bait" (i32.const 0)) (i32.const 1))

causes an assertion failure?

$ ./out/spectest-interp --trace ./playground/thing.json --enable-exceptions
#0.   12: V:1  | alloca 1
#0.   20: V:2  | local.get $2
#0.   28: V:3  | br_unless @44, 0
#0.   44: V:2  | i32.const 1
#0.   52: V:3  | local.set $2, 1
#0.   60: V:2  | call $0
#1.    0: V:2  | throw $0
#0.   76: V:1  | catch_drop 1
#0.   84: V:1  | local.get $1
#0.   92: V:2  | drop_keep $2 $1
#0.  104: V:0  | return
spectest-interp: /home/soniex2/git/github/wabt/src/interp/interp.cc:1078: void wabt::interp::Thread::PopValues(const ValueTypes &, Values *): Assertion `values_.size() >= types.size()' failed.
Aborted (core dumped)

(we noticed funny stuff at the throw $0, it appears the call to DoThrow is popping more values than it should... but we can't figure this out at all)

[SoniEx2]

we think we fixed it???