[wasm-gc][turbofan] Fix node typing in ref.cast optimized path

Bug: v8:7748
Change-Id: Id886fa4c734bbd826770239ea145630570915749
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723505Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81355}

src/wasm/graph-builder-interface.cc

@@ -486,7 +486,7 @@ class WasmGraphBuildingInterface {
   void AssertNull(FullDecoder* decoder, const Value& obj, Value* result) {
     builder_->TrapIfFalse(wasm::TrapReason::kTrapIllegalCast,
                           builder_->IsNull(obj.node), decoder->position());
-    result->node = obj.node;
+    Forward(decoder, obj, result);
   }
 
   void NopForTestingUnsupportedInLiftoff(FullDecoder* decoder) {}

test/mjsunit/regress/wasm/wasm-typer-incompatible-ref-cast.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-liftoff --experimental-wasm-gc
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let builder = new WasmModuleBuilder();
+let supertype = builder.addStruct([]);
+let sub1 = builder.addStruct([makeField(kWasmI32, true)], supertype);
+let sub2 = builder.addStruct([makeField(kWasmF64, true)], supertype);
+
+let crash = builder.addFunction("crash", kSig_v_i).exportFunc()
+ .addLocals(wasmOptRefType(sub1), 1)
+ .addBody([
+   kGCPrefix, kExprStructNewDefault, sub1,
+   kExprLocalSet, 1,
+   kExprLocalGet, 0,
+   kExprI32Eqz,
+   kExprIf, kWasmVoid,
+     kExprLocalGet, 1,
+     kGCPrefix, kExprStructGet, sub1, 0,
+     kExprDrop,
+   kExprElse,
+     kExprLocalGet, 1,
+     kGCPrefix, kExprRefCastStatic, sub2,
+     kGCPrefix, kExprStructGet, sub2, 0,
+     kExprDrop,
+   kExprEnd]);
+
+let instance = builder.instantiate();
+instance.exports.crash(0);
+assertThrows(() => instance.exports.crash(1),
+             WebAssembly.RuntimeError, 'illegal cast');