DRC panic where passive table elements are GC'd too soon

[alexcrichton]

This input:

(module
  (import "wasmtime" "gc" (func $gc))
  (type $s (struct (field i32)))
  (table $t 10 anyref)

  ;; Passive element segment with a GC struct
  (elem $e anyref (struct.new $s (i32.const 42)))

  ;; Copy passive element into table
  (func (export "init")
      (table.init $t $e (i32.const 0) (i32.const 0) (i32.const 1))
  )

  ;; Read the struct from the table and return its field value
  (func (export "get_field") (result i32)
      (struct.get $s 0
          (ref.cast (ref $s)
              (table.get $t (i32.const 0))
          )
      )
  )

  (export "gc" (func $gc))
)

(assert_return (invoke "gc"))
(assert_return (invoke "init"))
(assert_return (invoke "get_field") (i32.const 42))

panics with (using this PR's flag):

$ target/debug/wasmtime wast foo.wast -Wgc --wasmtime-builtins

thread 'main' (92813) panicked at crates/wasmtime/src/runtime/vm/gc/enabled/drc.rs:791:9:
assertion failed: self.ref_count > 0
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

This summary may be useful, may be off the mark.