[wasm] Add regression tests for 1239116

The fix is released now, so we can add the tests to the public repo.

R=ahaas@chromium.org

Bug: chromium:1239116
Change-Id: Ie1489f6bcd934f84222b4631921475c389f778dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172752Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76957}

test/mjsunit/regress/wasm/regress-1239116.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, true);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      kExprI32Const, 0,         // i32.const
+      kExprI32LoadMem8S, 0, 0,  // i32.load8_s
+      kExprI32LoadMem, 0, 0,    // i32.load
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+let mem = new Uint8Array(instance.exports.memory.buffer);
+mem[0] = -1;
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);

test/mjsunit/regress/wasm/regress-1239116b.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, true);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      kExprI32Const, 0,          // i32.const
+      kExprI32LoadMem16S, 0, 0,  // i32.load16_s
+      kExprI32LoadMem, 0, 0,     // i32.load
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+let mem = new Uint16Array(instance.exports.memory.buffer);
+mem[0] = -1;
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);