[liftoff] Add regression test for asan dcheck failure

Adding a regression test for https://crrev.com/c/1930606.

This test was generated using --dump-wasm-module, which created a 6KB
module, and then running binaryen's wasm-reduce on it until it churned
this out, and removing an extra kExprUnreachable.

Bug: chromium:1027410
Change-Id: I14ba6ebe52f45e3b3ba943088807e110eebe0339
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1933592Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65276}

test/mjsunit/regress/wasm/regress-1027410.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addType(makeSig([kWasmF64, kWasmF64, kWasmI32, kWasmI32], [kWasmI32]));
+  builder.addType(makeSig([], [kWasmF64]));
+  // Generate function 1 (out of 2).
+  builder.addFunction(undefined, 0 /* sig */)
+    .addBodyWithEnd([
+// signature: i_ddii
+// body:
+kExprI32Const, 0x01,
+kExprEnd,   // @3
+            ]);
+  // Generate function 2 (out of 2).
+  builder.addFunction(undefined, 1 /* sig */)
+    .addLocals({f64_count: 8})
+    .addBodyWithEnd([
+// signature: d_v
+// body:
+kExprBlock, kWasmF64,   // @3 f64
+  kExprBlock, kWasmStmt,   // @5
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprLocalTee, 0x00,
+    kExprLocalTee, 0x01,
+    kExprLocalTee, 0x02,
+    kExprLocalTee, 0x03,
+    kExprLocalTee, 0x04,
+    kExprLocalTee, 0x05,
+    kExprLocalTee, 0x06,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+    kExprLocalTee, 0x07,
+    kExprI32Const, 0x00,
+    kExprIf, kWasmI32,   // @52 i32
+      kExprI32Const, 0x00,
+    kExprElse,   // @56
+      kExprI32Const, 0x00,
+      kExprEnd,   // @59
+    kExprBrIf, 0x01,   // depth=1
+    kExprI32UConvertF64,
+    kExprI32Const, 0x00,
+    kExprCallFunction, 0x00, // function #0: i_ddii
+    kExprDrop,
+    kExprUnreachable,
+    kExprEnd,   // @70
+  kExprUnreachable,
+  kExprEnd,   // @72
+kExprEnd,   // @73
+            ]);
+  assertDoesNotThrow(function() { builder.instantiate(); });
+})();