[wasm] Check segment bounds beforehand

test/cctest/wasm/test-run-wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <string.h>
 
 #include "src/snapshot/code-serializer.h"
 #include "src/version.h"
 #include "src/wasm/module-decoder.h"
@@ skipping 897 matching lines @@
         kMemorySectionCode,     // --
         U32V_1(4),              // section size
         ENTRY_COUNT(1),         // --
         kResizableMaximumFlag,  // --
         0,                      // initial size
         0,                      // maximum size
         kDataSectionCode,       // --
         U32V_1(6),              // section size
         ENTRY_COUNT(1),         // --
         0,                      // linear memory index
-        WASM_I32V_1(24),        // destination offset
+        WASM_I32V_1(0),         // destination offset
         kExprEnd,
         U32V_1(0),  // source size
     };
 
     testing::CompileInstantiateWasmModuleForTesting(isolate, &thrower, data,
                                                     data + arraysize(data),
                                                     ModuleOrigin::kWasmOrigin);
     // It should be possible to instantiate this module.
     CHECK(!thrower.error());
   }
@@ skipping 21 matching lines @@
         ENTRY_COUNT(1),          // --
         0,                       // linear memory index
         WASM_I32V_4(0x2468ace),  // destination offset
         kExprEnd,
         U32V_1(0),  // source size
     };
 
     testing::CompileInstantiateWasmModuleForTesting(isolate, &thrower, data,
                                                     data + arraysize(data),
                                                     ModuleOrigin::kWasmOrigin);
-    // It should be possible to instantiate this module.
-    CHECK(!thrower.error());
+    // It should not be possible to instantiate this module.
+    CHECK(thrower.error());
   }
   Cleanup();
 }