From 2860dd15c99054300dc3d1bdb78d999c662dcd5f Mon Sep 17 00:00:00 2001
From: stevenfontanella <stevenfont@chromium.org>
Date: Tue, 10 Mar 2026 17:47:59 +0000
Subject: [PATCH] Fix nullref assertion

---
 src/tools/wasm-shell.cpp |  3 ++-
 test/lit/basic/ref.wast  | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 test/lit/basic/ref.wast

diff --git a/src/tools/wasm-shell.cpp b/src/tools/wasm-shell.cpp
index 30cf4bcf84c..ca864998714 100644
--- a/src/tools/wasm-shell.cpp
+++ b/src/tools/wasm-shell.cpp
@@ -368,7 +368,8 @@ struct Shell {
       }
     } else if (auto* ref = std::get_if<RefResult>(&expected)) {
       if (!val.type.isRef() ||
-          !HeapType::isSubType(val.type.getHeapType(), ref->type)) {
+          !HeapType::isSubType(val.type.getHeapType(), ref->type) ||
+          val.isNull()) {
         err << ref->type;
         return AlternativeErr{err.str()};
       }
diff --git a/test/lit/basic/ref.wast b/test/lit/basic/ref.wast
new file mode 100644
index 00000000000..f30c323fd0e
--- /dev/null
+++ b/test/lit/basic/ref.wast
@@ -0,0 +1,10 @@
+;; RUN: not wasm-shell %s 2>&1 | filecheck %s
+
+(module
+  (func (export "f") (result (ref null i31))
+    (ref.null i31)
+  )
+)
+
+;; CHECK: expected i31, got nullref
+(assert_return (invoke "f") (ref.i31))