tcg/wasm32: add opt-in ?noremove to leak TB functions

Skips removeFunction recycling of WASM table indices. nostoretci+noremove still
crashes 4/4, ruling out table-index reuse as the corruption source and leaving a
vCPU/IO-thread guest-RAM data race as the standing hypothesis.

tcg/wasm32.c

@@ -138,6 +138,13 @@ int cur_core_num_max = 0;
 __thread static int to_remove_instance[TO_REMOVE_INSTANCE_SIZE];
 __thread static int to_remove_instance_idx = 0;
 
+int wasm_disable_tb_removal;
+
+EMSCRIPTEN_KEEPALIVE void wasm_set_disable_tb_removal(void)
+{
+    wasm_disable_tb_removal = 1;
+}
+
 void remove_tb(void *tb_ptr) {
     int32_t *slot = (int32_t*)((uint8_t*)tb_ptr + export_vec_off);
     int32_t f = *slot;
@@ -145,6 +152,11 @@ void remove_tb(void *tb_ptr) {
         return;
     }
     *slot = 0;
+    /* E18: leak the wasm function instead of recycling its table index, to test
+     * whether removeFunction index reuse is the corruption source. */
+    if (wasm_disable_tb_removal) {
+        return;
+    }
     if (to_remove_instance_idx == TO_REMOVE_INSTANCE_SIZE) {
         flush_tb_instances();
     }