This fixes a use-after-free of a WebAssembly GC type definition caused by only retaining the expanded type. A struct/array type can be a Subtype that wraps an underlying Struct/Array TypeDefinition; WebAssemblyGCStructure stored only m_type, set to the expanded underlying type (typeSignatures[i]->expand()). But, as the added comment states, the original unexpanded Subtype ‘may be the target of raw pointers in Wasm::Types of FieldTypes’ — field types hold raw pointers into the unexpanded Subtype. Because nothing kept the unexpanded Subtype alive, TypeInformation::tryCleanup() could free that TypeDefinition during GC while those raw FieldType pointers still referenced it, giving a dangling pointer and memory corruption.

The fix threads the unexpanded type through: JSWebAssemblyInstance::finishCreation now passes typeSignatures[i] (unexpanded) rather than ->expand(); JSWebAssemblyArray/Struct::createStructure expand internally and pass BOTH the unexpanded and expanded types; and WebAssemblyGCStructure gains a Ref<const Wasm::TypeDefinition> m_unexpandedType member (copied on structure transition) that keeps the Subtype alive for the structure’s lifetime.

The restored invariant is that any TypeDefinition referenced by raw pointers from FieldTypes remains owned as long as the structure exists. The regression test builds structs using a Subtype (isFinal=false), drops references, and GCs repeatedly to drive tryCleanup() into freeing the type. Established by the diff (the wasm-module-builder-gc.js harness is omitted but only provides module-building helpers).