[stringrefs] stringview_wtf16.slice end position is exclusive

See https://github.com/WebAssembly/stringref/pull/31.

Bug: v8:12868
Change-Id: Iefe6b8e6c1b6f2eed8a2aca1818d5edbf6ab48ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3747874
Commit-Queue: Andy Wingo <wingo@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81571}

src/builtins/wasm.tq

@@ -915,8 +915,8 @@ transitioning builtin WasmStringViewWtf16Slice(
     string: String, start: uint32, end: uint32): String {
   const length = Unsigned(string.length);
   if (start >= length) return kEmptyString;
-  if (end < start) return kEmptyString;
-  const clampedEnd = Convert<uintptr>(end < length ? end + 1 : length);
+  if (end <= start) return kEmptyString;
+  const clampedEnd = Convert<uintptr>(end <= length ? end : length);
   return string::SubString(string, Convert<uintptr>(start), clampedEnd);
 }
 }

test/mjsunit/wasm/stringrefs-exec.js

@@ -751,10 +751,13 @@ function makeWtf16TestDataSegment() {
   assertThrows(() => instance.exports.encode("foo", memory.length - 1, 0, 3),
                WebAssembly.RuntimeError, "memory access out of bounds");
 
-  assertEquals("f", instance.exports.slice("foo", 0, 0));
-  assertEquals("fo", instance.exports.slice("foo", 0, 1));
-  assertEquals("foo", instance.exports.slice("foo", 0, 2));
-  assertEquals("oo", instance.exports.slice("foo", 1, 2));
+  assertEquals("", instance.exports.slice("foo", 0, 0));
+  assertEquals("f", instance.exports.slice("foo", 0, 1));
+  assertEquals("fo", instance.exports.slice("foo", 0, 2));
+  assertEquals("foo", instance.exports.slice("foo", 0, 3));
+  assertEquals("foo", instance.exports.slice("foo", 0, 4));
+  assertEquals("o", instance.exports.slice("foo", 1, 2));
+  assertEquals("oo", instance.exports.slice("foo", 1, 3));
   assertEquals("oo", instance.exports.slice("foo", 1, 100));
   assertEquals("", instance.exports.slice("foo", 1, 0));