[Wasm GC] Handle an unreachable br_on_cast_fail in DCE (#5418)

Without this we hit an assertion on unreachable not being a heap type.

2 files changed, 19 insertions, 3 deletions

diff --git a/src/wasm/wasm.cpp b/src/wasm/wasm.cpp
index 4a72f6ea6..fa1351541 100644
--- a/src/wasm/wasm.cpp
+++ b/src/wasm/wasm.cpp
@@ -1014,7 +1014,10 @@ Type BrOn::getSentType() {
         return castType;
       }
     case BrOnCastFail:
-      // The same as the result type of br_on_cast.
+      // The same as the result type of br_on_cast (if reachable).
+      if (ref->type == Type::unreachable) {
+        return Type::unreachable;
+      }
       if (castType.isNullable()) {
         return Type(ref->type.getHeapType(), NonNullable);
       } else {
diff --git a/test/lit/passes/dce_all-features.wast b/test/lit/passes/dce_all-features.wast
index 8566b86f0..24bb751fc 100644
--- a/test/lit/passes/dce_all-features.wast
+++ b/test/lit/passes/dce_all-features.wast
@@ -1398,10 +1398,10 @@
 (module
   ;; CHECK:      (type $none_=>_ref|any| (func (result (ref any))))
 
-  ;; CHECK:      (func $foo (type $none_=>_ref|any|) (result (ref any))
+  ;; CHECK:      (func $br_on_non_null (type $none_=>_ref|any|) (result (ref any))
   ;; CHECK-NEXT:  (unreachable)
   ;; CHECK-NEXT: )
-  (func $foo (result (ref any))
+  (func $br_on_non_null (result (ref any))
     (block $label$1 (result (ref any))
       ;; this break has an unreachable input, and so it does not have a heap type
       ;; there, and no heap type to send on the branch. this tests we do not hit
@@ -1414,4 +1414,17 @@
       (unreachable)
     )
   )
+
+  ;; CHECK:      (func $br_on_cast_fail (type $none_=>_ref|any|) (result (ref any))
+  ;; CHECK-NEXT:  (unreachable)
+  ;; CHECK-NEXT: )
+  (func $br_on_cast_fail (result (ref any))
+    (block $label$1 (result (ref none))
+      ;; Similar to the above, but using br_on_cast_fail.
+      (br_on_cast_fail $label$1 null struct
+        (unreachable)
+      )
+      (unreachable)
+    )
+  )
 )