[wasm] Fix bounds check in LoadDataSegments.

test/cctest/wasm/test-run-wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <string.h>
 
 #include "src/snapshot/code-serializer.h"
 #include "src/version.h"
 #include "src/wasm/module-decoder.h"
@@ skipping 784 matching lines @@
 
 TEST(Run_WasmModule_Global_f32) {
   RunWasmModuleGlobalInitTest<float>(kAstF32, -983.9f);
   RunWasmModuleGlobalInitTest<float>(kAstF32, 1122.99f);
 }
 
 TEST(Run_WasmModule_Global_f64) {
   RunWasmModuleGlobalInitTest<double>(kAstF64, -833.9);
   RunWasmModuleGlobalInitTest<double>(kAstF64, 86374.25);
 }
+
+TEST(InitDataAtTheUpperLimit) {
+  {
+    Isolate* isolate = CcTest::InitIsolateOnce();
+    HandleScope scope(isolate);
+    testing::SetupIsolateForWasmModule(isolate);
+
+    ErrorThrower thrower(isolate, "Run_WasmModule_InitDataAtTheUpperLimit");
+
+    const byte data[] = {
+        WASM_MODULE_HEADER,     // --
+        kMemorySectionCode,     // --
+        U32V_1(4),              // section size
+        ENTRY_COUNT(1),         // --
+        kResizableMaximumFlag,  // --
+        1,                      // initial size
+        2,                      // maximum size
+        kDataSectionCode,       // --
+        U32V_1(9),              // section size
+        ENTRY_COUNT(1),         // --
+        0,                      // linear memory index
+        WASM_I32V_3(0xffff),    // destination offset
+        kExprEnd,
+        U32V_1(1),  // source size
+        'c'         // data bytes
+    };
+
+    testing::CompileInstantiateWasmModuleForTesting(isolate, &thrower, data,
+                                                    data + arraysize(data),
+                                                    ModuleOrigin::kWasmOrigin);
+    if (thrower.error()) {
+      thrower.Reify()->Print();
+      CHECK(false);
+    }
+  }
+  Cleanup();
+}