WebAssemblyGCTypeDependencies collects the set of Wasm GC type definitions a value depends on, so those definitions are kept alive while the dependent object (here a WebAssembly tag/exception referencing a struct-typed reference) exists.

The bug is a lifetime/liveness-tracking error rooted in how the traversal handled expanded vs. unexpanded type definitions. In the vulnerable code the constructor immediately called unexpandedType->expand() and appended the expanded form to the worklist, while only recording typeHash(unexpandedType) in m_typeDefinitions; appendToWorkIfNeeded similarly appended TypeInformation::get(type.index).expand(). process then keyed its visited-set and StructType/ArrayType/FunctionSignature recursion off the raw typeDef it received. The consequence is an inconsistent set of hashes recorded in m_typeDefinitions: the constructor recorded the unexpanded hash but pushed the expanded object, so the dependency set could omit either the unexpanded or the expanded definition that is actually reachable and must be retained. When a type definition is a recursive/sub-typed struct (the regression test builds (sub (struct (field i32))) reached through a func signature parameter (ref $sub1)), the definition that is truly referenced may not be registered as a dependency, so a later TypeInformation cleanup/GC (callTypeInformationTryCleanup runs gc()) can reclaim a TypeDefinition that is still needed.

The patch restores the invariant that every reachable definition — both the node as received and its expansion when they differ — is registered before recursion: the constructor now appends unexpandedType.get() (the unexpanded node) and drops the standalone m_typeDefinitions.add; appendToWorkIfNeeded appends the non-expanded TypeInformation::get(type.index); and process now computes expand() locally, and when the expansion differs from the node it checks-and-adds typeHash(expanded) (with early-out if already visited) before switching all the is<StructType>()/as<...>() recursion to operate on expanded. This guarantees both hashes are tracked and that structural recursion walks the expanded shape, closing the gap that let a live dependency be collected. (Inference: that the missing registration leads to premature reclamation and use-after-free of a TypeDefinition is deduced from the regression harness forcing gc() between tag creation and use plus the LogicError/crash description; the actual free/use sites are in TypeInformation and the exception-matching path, not shown in this diff.)

The patch fixes a dependency-tracking gap that can leave a still-referenced Wasm GC TypeDefinition unregistered and thus eligible for premature reclamation, an object-lifetime (use-after-free-flavored) bug rather than a bounded numeric overflow. The commit establishes an unexpected process crash (LogicError, medium); the diff does not demonstrate a controllable UAF or write primitive, and reaching it requires attacker-defined recursive GC types plus a GC at the right moment. It is confined to the sandboxed WebContent process running the Wasm engine. Escalation to RCE would require demonstrating deterministic reuse of the reclaimed TypeDefinition and heap grooming that the commit does not show.