[wasm] Fix bounds check for zero initial memory.

src/assembler.cc

 // Copyright (c) 1994-2006 Sun Microsystems Inc.
 // All Rights Reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 // - Redistributions of source code must retain the above copyright notice,
 // this list of conditions and the following disclaimer.
 //
@@ skipping 334 matching lines @@
     Address updated_reference;
     DCHECK_GE(wasm_memory_reference(), old_base);
     updated_reference = new_base + (wasm_memory_reference() - old_base);
     // The reference is not checked here but at runtime. Validity of references
     // may change over time.
     unchecked_update_wasm_memory_reference(updated_reference,
                                            icache_flush_mode);
   } else if (IsWasmMemorySizeReference(rmode_)) {
     uint32_t current_size_reference = wasm_memory_size_reference();
     DCHECK(old_size == 0 || current_size_reference <= old_size);
-    uint32_t offset = old_size - current_size_reference;
-    DCHECK_GE(new_size, offset);
-    uint32_t updated_size_reference = new_size - offset;
+    uint32_t updated_size_reference =
+        new_size + (current_size_reference - old_size);
     unchecked_update_wasm_memory_size(updated_size_reference,
                                       icache_flush_mode);
   } else {
     UNREACHABLE();
   }
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
     Assembler::FlushICache(isolate_, pc_, sizeof(int64_t));
   }
 }
 
@@ skipping 1571 matching lines @@
 
 
 void Assembler::DataAlign(int m) {
   DCHECK(m >= 2 && base::bits::IsPowerOfTwo32(m));
   while ((pc_offset() & (m - 1)) != 0) {
     db(0);
   }
 }
 }  // namespace internal
 }  // namespace v8