[Parser] Error properly on br_on* going to a target without a value (#7338)

Internally we subtract 1 from the number of values while
processing such things, but if we start with 0 we'd overflow
and hit a confusing error later.

Fixes the last part of #7337

Author: kripken

src/wasm/wasm-ir-builder.cpp

@@ -1974,6 +1974,9 @@ Result<> IRBuilder::makeBrOn(Index label, BrOnOp op, Type in, Type out) {
     case BrOnCast:
     case BrOnCastFail:
       // Modeled as sending one value.
+      if (extraArity == 0) {
+        return Err{"br_on target does not expect a value"};
+      }
       extraArity -= 1;
       break;
   }

test/lit/parse-bad-gc-br_on-novalue.wast

@@ -0,0 +1,17 @@
+;; RUN: not wasm-opt %s -all 2>&1 | filecheck %s
+
+;; Check we error properly when a block has no value, but a br_on with a value
+;; targets it.
+
+(module
+  ;; CHECK: 10:7: error: br_on target does not expect a value
+  (func $f
+    (block $foo
+      (br_on_cast $foo (ref eq) (ref eq)
+        (ref.i31
+          (i32.const 0)
+        )
+      )
+    )
+  )
+)