2 files changed, 30 insertions, 6 deletions
diff --git a/src/tools/fuzzing/fuzzing.cpp b/src/tools/fuzzing/fuzzing.cpp
index cdefe29f1..cc64b3b6a 100644
--- a/src/tools/fuzzing/fuzzing.cpp
+++ b/src/tools/fuzzing/fuzzing.cpp
@@ -1968,6 +1968,10 @@ Expression* TranslateToFuzzReader::makeConstBasicRef(Type type) {
   assert(heapType.isBasic());
   assert(wasm.features.hasReferenceTypes());
   switch (heapType.getBasic()) {
+    case HeapType::ext: {
+      assert(type.isNullable() && "Cannot handle non-nullable externref");
+      return builder.makeRefNull(type);
+    }
     case HeapType::func: {
       return makeRefFuncConst(type);
     }
@@ -3089,13 +3093,14 @@ HeapType TranslateToFuzzReader::getSubType(HeapType type) {
       case HeapType::func:
         // TODO: Typed function references.
         return HeapType::func;
+      case HeapType::ext:
+        return HeapType::ext;
       case HeapType::any:
         // TODO: nontrivial types as well.
         return pick(
           FeatureOptions<HeapType>()
-            .add(FeatureSet::ReferenceTypes, HeapType::func, HeapType::any)
+            .add(FeatureSet::ReferenceTypes, HeapType::func /*, HeapType::ext*/)
             .add(FeatureSet::ReferenceTypes | FeatureSet::GC,
-                 HeapType::func,
                  HeapType::any,
                  HeapType::eq,
                  HeapType::i31,
diff --git a/src/tools/fuzzing/heap-types.cpp b/src/tools/fuzzing/heap-types.cpp
index 364065b8b..5a8f0fc0e 100644
--- a/src/tools/fuzzing/heap-types.cpp
+++ b/src/tools/fuzzing/heap-types.cpp
@@ -153,6 +153,7 @@ struct HeapTypeGeneratorImpl {
 
   HeapType::BasicHeapType generateBasicHeapType() {
     return rand.pick(HeapType::func,
+                     HeapType::ext,
                      HeapType::any,
                      HeapType::eq,
                      HeapType::i31,
@@ -278,6 +279,7 @@ struct HeapTypeGeneratorImpl {
       return type;
     } else {
       switch (type) {
+        case HeapType::ext:
         case HeapType::i31:
           // No other subtypes.
           return type;
@@ -371,6 +373,8 @@ struct HeapTypeGeneratorImpl {
       // This is not a constructed type, so it must be a basic type.
       assert(type.isBasic());
       switch (type.getBasic()) {
+        case HeapType::ext:
+          return HeapType::ext;
         case HeapType::func:
           return pickSubFunc();
         case HeapType::any:
@@ -477,16 +481,31 @@ struct HeapTypeGeneratorImpl {
       switch (*basic) {
         case HeapType::func:
           return SignatureKind{};
+        case HeapType::ext:
         case HeapType::i31:
           return super;
         case HeapType::any:
-          return generateHeapTypeKind();
+          if (rand.oneIn(4)) {
+            switch (rand.upTo(3)) {
+              case 0:
+                return HeapType::eq;
+              case 1:
+                return HeapType::i31;
+              case 2:
+                return HeapType::data;
+            }
+          }
+          return DataKind{};
         case HeapType::eq:
           if (rand.oneIn(4)) {
-            return HeapType::i31;
-          } else {
-            return DataKind{};
+            switch (rand.upTo(2)) {
+              case 0:
+                return HeapType::i31;
+              case 1:
+                return HeapType::data;
+            }
           }
+          return DataKind{};
         case HeapType::data:
           return DataKind{};
         case HeapType::string: