1 files changed, 3 insertions, 0 deletions
diff --git a/src/wasm/wasm-binary.cpp b/src/wasm/wasm-binary.cpp
index b76a789de..b23478205 100644
--- a/src/wasm/wasm-binary.cpp
+++ b/src/wasm/wasm-binary.cpp
@@ -7320,6 +7320,9 @@ bool WasmBinaryReader::maybeVisitBrOn(Expression*& out, uint32_t code) {
   }
   auto name = getBreakTarget(getU32LEB()).name;
   auto* ref = popNonVoidExpression();
+  if (!ref->type.isRef() && ref->type != Type::unreachable) {
+    throwError("bad input type for br_on*");
+  }
   if (isCast) {
     auto inputNullability = (flags & 1) ? Nullable : NonNullable;
     auto castNullability = (flags & 2) ? Nullable : NonNullable;