I think we already do the right thing, but this recently got formalized and we should double-check: https://github.com/WebAssembly/design/pull/1016 Validation is documented here: https://encoding.spec.whatwg.org/#utf-8-decode-without-bom-or-fail While we're there, also check that we don't normalize.
FWIW the new test hasn't been committed yet: https://github.com/WebAssembly/spec/pull/450
Keith says this is done.