[super ic] Add tests for an already fixed security bug

Bug: chromium:1203122
Change-Id: Ief88320b620dbf2f347bf6f6fc1ebd459e60af3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138194Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76639}

test/mjsunit/regress/regress-crbug-1203122-1.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function main() {
+  class C {
+    m() {
+      super.prototype;
+    }
+  }
+  // Home object's __proto__ is a function.
+  function f() {}
+  C.prototype.__proto__ = f;
+
+  let c = new C();
+
+  f.prototype;
+  c.m();
+}
+
+for (let i = 0; i < 100; ++i) {
+  main();
+}

test/mjsunit/regress/regress-crbug-1203122-2.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function main() {
+  class A {}
+  A.prototype.prototype = 'a string';
+  class C extends A {
+    m() {
+      super.prototype;
+    }
+  }
+  function f() {}
+
+  // Create handler; receiver is a function.
+  C.prototype.m.call(f);
+  // Use handler; receiver not a function.
+  C.prototype.m.call('not a function');
+}
+
+for (let i = 0; i < 100; ++i) {
+  main();
+}