[test] Make tests pass with the GC fuzzer.

The tests need to properly hold on to the original fast-mode map,
otherwise the GC might clear that, and so the NormalizedMapCache
lookup would fail due to that.

Bug: chromium:963411, v8:9114, v8:9183, v8:9267
Change-Id: Ic41ed363959a5c182c74097767dc14c366076e17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627333Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61772}

test/mjsunit/mjsunit.status

@@ -830,7 +830,6 @@
   # to GC.
   'compiler/native-context-specialization-hole-check': [SKIP],
   'regress/regress-trap-allocation-memento': [SKIP],
-  'regress/regress-v8-9267-*': [SKIP],
   'shared-function-tier-up-turbo': [SKIP],
 }],  # 'gc_fuzzer'
 

test/mjsunit/regress/regress-v8-9267-1.js

@@ -14,7 +14,8 @@ function foo() {
 
 %NeverOptimizeFunction(bar);
 %PrepareFunctionForOptimization(foo);
-bar(foo());
+const o = foo();  // Keep a reference so the GC doesn't kill the map.
+bar(o);
 const a = bar(foo());
 %OptimizeFunctionOnNextCall(foo);
 const b = bar(foo());

test/mjsunit/regress/regress-v8-9267-2.js

@@ -14,7 +14,8 @@ function foo() {
 
 %NeverOptimizeFunction(bar);
 %PrepareFunctionForOptimization(foo);
-bar(foo());
+const o = foo();  // Keep a reference so the GC doesn't kill the map.
+bar(o);
 const a = bar(foo());
 %OptimizeFunctionOnNextCall(foo);
 const b = bar(foo());