Bug 252539

Running the following test with the bytecode dumper enabled:

```
import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
  for (let i = 0; i < bytes.length; ++i) {
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

function testArray() {
    let m = instantiate(`(module
  (type $bvec (array i8))
  (type $a (array (ref $bvec)))

  (func $new (export "new") (result (ref $a))
   (array.new_canon $a (array.new_canon_default $bvec (i32.const 2)) (i32.const 42))))`);
}

testArray();
```

command line: `jsc  -m --useWebAssemblyTypedFunctionReferences\=true --useWebAssemblyGC\=true --dumpGeneratedWasmBytecodes=true test_array.js`

results in a crash:

```
<?>.wasm-function[0] : () -> [Ref]
wasm size: 12 bytes
bytecode: 5 instructions (0 16-bit instructions, 1 32-bit instructions); 33 bytes; 0 parameter(s); 18 local(s); 20 callee register(s)
[   0] enter              
[   1] **array_new        dst:loc18, size:SHOULD NEVER BE REACHED
/home/tjc/WebKit/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp(438) : WTF::CString JSC::Wasm::BytecodeDumper::formatConstant(JSC::Wasm::Type, uint64_t) const
Aborted (core dumped)
```

I have a fix for this, which I'll submit shortly.