Bug 252719 – [Wasm-GC] Air and B3 generate struct.get/set code with wrong offsets

• Component: WebAssembly
• Status: RESOLVED FIXED

[Tim Chevalier]

The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
  for (let i = 0; i < bytes.length; ++i) {
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

let iterations = 10;

function testIntFields() {

  let m = instantiate(`
    (module
      (type $s (struct (field i32) (field i32)))

      (func $new (export "new") (result (ref $s))
         (struct.new_canon $s (i32.const 1) (i32.const 5)))

      (func (export "len0") (result i32)
         (struct.get $s 0 (call $new)))
      (func (export "len1") (result i32)
         (struct.get $s 1 (call $new))))`);

    for (var i = 0; i < 10; i++) {
        assert.eq(m.exports.len0(), 1);
        assert.eq(m.exports.len1(), 5);
    }
}
testIntFields();
```

fails, because the `addStructGet` and `addStructSet` methods in `WasmAirIRGeneratorBase.h` emit a load of `s.m_payload.m_storage` (if `s` is the struct object being operated on) followed by a load or store with the offset for the field being read from/written to. This is incorrect because the field offset is relative to `s.m_payload.m_storage.data()`, not `s.m_payload.m_storage`. 

I'll be submitting a PR.

[Tim Chevalier]

Pull request: https://github.com/WebKit/WebKit/pull/10490

[Radar WebKit Bug Importer]

<rdar://problem/106065099>

[EWS]

Committed 261899@main (2e2ee48591cd): <https://commits.webkit.org/261899@main>

Reviewed commits have been landed. Closing PR #10490 and removing active labels.