Fix pop assertion (#5777)

Subtypes are allowed as well, not just exact matches, in the pop value's type.

2 files changed, 29 insertions, 1 deletions

diff --git a/src/wasm-interpreter.h b/src/wasm-interpreter.h
index 0e74af02a..2a522c732 100644
--- a/src/wasm-interpreter.h
+++ b/src/wasm-interpreter.h
@@ -3815,7 +3815,7 @@ public:
     NOTE_ENTER("Pop");
     assert(!multiValues.empty());
     auto ret = multiValues.back();
-    assert(curr->type == ret.getType());
+    assert(Type::isSubType(ret.getType(), curr->type));
     multiValues.pop_back();
     return ret;
   }
diff --git a/test/lit/exec/eh-gc.wast b/test/lit/exec/eh-gc.wast
new file mode 100644
index 000000000..cac2f6adf
--- /dev/null
+++ b/test/lit/exec/eh-gc.wast
@@ -0,0 +1,28 @@
+;; NOTE: Assertions have been generated by update_lit_checks.py --output=fuzz-exec and should not be edited.
+
+;; RUN: wasm-opt %s -all --fuzz-exec -q -o /dev/null 2>&1 | filecheck %s
+
+(module
+ (tag $tag (param externref))
+
+ ;; CHECK:      [fuzz-exec] calling catch-null
+ (func "catch-null"
+  (try $label$3
+   (do
+    ;; Throw a null.
+    (throw $tag
+     (ref.null noextern)
+    )
+   )
+   (catch $tag
+    ;; The popped type here is more refined than external (it is a bottom type)
+    ;; which we should not error on.
+    (drop
+     (pop externref)
+    )
+   )
+  )
+ )
+)
+;; CHECK:      [fuzz-exec] calling catch-null
+;; CHECK-NEXT: [fuzz-exec] comparing catch-null