wasm-opt reports validation error on input module that actually works on Chrome and Firefox

[konsoletyper]

Steps to reproduce

1. Get attached file classTest.wasm.tar.gz
2. Run wasm-opt -O3 --all-features classTest.wasm

Actual result

Tool reports following:

[wasm-validator error in function org.teavm.junit.TestEntryPoint::run] break type must be a subtype of the target block type, on 
(block $label$5 (result (ref null $java.lang.Object))
 (drop
  (ref.null none)
 )
 (local.set $10
  (br_on_null $label$5
   (call $java.util.AbstractList$1::next
    (local.get $3)
   )
  )
 )
 (drop
  (br_if $label$5
   (local.get $10)
   (call $org.teavm.junit.TestEntryPoint$Launcher@isSupertypes
    (struct.get $java.lang.Object $class
     (local.get $10)
    )
   )
  )
 )
 (throw $tag$0
  (call $org.teavm.backend.wasm.runtime.WasmGCSupport::cce)
 )
)
Fatal: error validating input

Notes

I think relevant part is following:

 (drop
  (ref.null none)
 )

initially it was

(; 0000cb68 ;)          block $label_4 (ref null (; 1 ;) $java.lang.Object)
(; 0000cb6b ;)            ref.null (ref null (; 1 ;) $java.lang.Object)
(; 0000cb6d ;)            local.get 3
(; 0000cb6f ;)            call (; 176 ;) $java.util.AbstractList$1::next
(; 0000cb72 ;)            br_on_null $label_4

where ref.null is an argument to br_on_null. Without it module does not pass validation

[kripken]

Looks like the same issue as in #6229, which is that we don't yet support values added to br_on instructions.