Bug 252719

The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
  for (let i = 0; i < bytes.length; ++i) {
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

let iterations = 10;

function testIntFields() {

  let m = instantiate(`
    (module
      (type $s (struct (field i32) (field i32)))

      (func $new (export "new") (result (ref $s))
         (struct.new_canon $s (i32.const 1) (i32.const 5)))

      (func (export "len0") (result i32)
         (struct.get $s 0 (call $new)))
      (func (export "len1") (result i32)
         (struct.get $s 1 (call $new))))`);

    for (var i = 0; i < 10; i++) {
        assert.eq(m.exports.len0(), 1);
        assert.eq(m.exports.len1(), 5);
    }
}
testIntFields();
```

fails, because the `addStructGet` and `addStructSet` methods in `WasmAirIRGeneratorBase.h` emit a load of `s.m_payload.m_storage` (if `s` is the struct object being operated on) followed by a load or store with the offset for the field being read from/written to. This is incorrect because the field offset is relative to `s.m_payload.m_storage.data()`, not `s.m_payload.m_storage`. 

I'll be submitting a PR.