2 files changed, 52 insertions, 1 deletions
diff --git a/test/passes/Oz_fuzz-exec_all-features.txt b/test/passes/Oz_fuzz-exec_all-features.txt
index ed235ed21..d035309e2 100644
--- a/test/passes/Oz_fuzz-exec_all-features.txt
+++ b/test/passes/Oz_fuzz-exec_all-features.txt
@@ -18,16 +18,20 @@
 [LoggingExternalInterface logging 1]
 [LoggingExternalInterface logging 0]
 [LoggingExternalInterface logging 1]
+[fuzz-exec] calling br_on_cast
+[LoggingExternalInterface logging 3]
+[trap unreachable]
 (module
  (type ${i32} (struct (field i32)))
- (type ${i32_f64} (struct (field i32) (field f64)))
  (type $none_=>_none (func))
+ (type ${i32_f64} (struct (field i32) (field f64)))
  (type $[mut:i8] (array (mut i8)))
  (type $i32_=>_none (func (param i32)))
  (import "fuzzing-support" "log-i32" (func $log (param i32)))
  (export "structs" (func $0))
  (export "arrays" (func $1))
  (export "rtts" (func $2))
+ (export "br_on_cast" (func $3))
  (func $0 (; has Stack IR ;)
   (local $0 (ref null ${i32}))
   (call $log
@@ -184,6 +188,12 @@
    )
   )
  )
+ (func $3 (; has Stack IR ;)
+  (call $log
+   (i32.const 3)
+  )
+  (unreachable)
+ )
 )
 [fuzz-exec] calling structs
 [LoggingExternalInterface logging 0]
@@ -205,3 +215,6 @@
 [LoggingExternalInterface logging 1]
 [LoggingExternalInterface logging 0]
 [LoggingExternalInterface logging 1]
+[fuzz-exec] calling br_on_cast
+[LoggingExternalInterface logging 3]
+[trap unreachable]
diff --git a/test/passes/Oz_fuzz-exec_all-features.wast b/test/passes/Oz_fuzz-exec_all-features.wast
index e12ddeed0..cf2e182e4 100644
--- a/test/passes/Oz_fuzz-exec_all-features.wast
+++ b/test/passes/Oz_fuzz-exec_all-features.wast
@@ -141,4 +141,42 @@
    )
   )
  )
+ (func "br_on_cast"
+  (local $any anyref)
+  ;; create a simple $struct, store it in an anyref
+  (local.set $any
+   (struct.new_default_with_rtt $struct (rtt.canon $struct))
+  )
+  (drop
+   (block $block (result ($ref $struct))
+    (drop
+     (block $extendedblock (result (ref $extendedstruct))
+      (drop
+       ;; second, try to cast our simple $struct to what it is, which will work
+       (br_on_cast $block $struct
+        ;; first, try to cast our simple $struct to an extended, which will fail
+        (br_on_cast $extendedblock $extendedstruct
+         (local.get $any) (rtt.canon $extendedstruct)
+        )
+        (rtt.canon $struct)
+       )
+      )
+      (call $log (i32.const -1)) ;; we should never get here
+      (return)
+     )
+    )
+    (call $log (i32.const -2)) ;; we should never get here either
+    (return)
+   )
+  )
+  (call $log (i32.const 3)) ;; we should get here
+  (drop
+   (block $never (result (ref $extendedstruct))
+    ;; an untaken br_on_cast, with unreachable rtt - so we cannot use the
+    ;; RTT in binaryen IR to find the cast type.
+    (br_on_cast $never $extendedstruct (ref.null $struct) (unreachable))
+    (unreachable)
+   )
+  )
+ )
 )