JavaScriptCore’s WebAssembly Table and Global store their element/value type as a Wasm::Type that, for reference types, carries a TypeIndex into the interned TypeInformation registry.

Pre-patch, WasmTable and WasmGlobal held that Wasm::Type (m_wasmType / m_type) WITHOUT retaining the underlying TypeDefinition. When the module that defined the type went away, the TypeDefinition the TypeIndex refers to could be freed while the Table/Global lived on, leaving m_type’s TypeIndex dangling; a later type-directed operation on the table/global dereferences the freed TypeDefinition — a use-after-free.

The fix retains the definition: WasmTable gains RefPtr<const TypeDefinition> m_wasmTypeDefinition and WasmGlobal gains RefPtr<const Wasm::TypeDefinition> m_typeDefinition, both initialized with a new TypeInformation::getRef(type.index) that returns the interned TypeDefinition (or nullptr when the index is a primitive type or invalid). Holding that RefPtr keeps the definition alive for the object’s lifetime, so the TypeIndex cannot dangle.

The restored invariant is that a Table/Global naming a reference type retains that type’s definition. (Note: this fix retains the directly-named definition; a later follow-up extended retention to the whole transitive type closure after finding nested types could still dangle.)

A use-after-free of a wasm TypeDefinition retained only by index in a Table/Global that outlives its module, reachable from crafted wasm in the WebContent process. GC timing is attacker-influenced, giving a groomable UAF; the observable is a crash. Confined to WebContent; rated medium. This is the root fix of a class later hardened (transitive retention) in a follow-up.