[web snapshot] Verify deserialized objects in tests

Bug: v8:11525
Change-Id: I35e582c4ca6da794bab8bce1dfb59e2bb8f0096b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395559
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78654}

test/mjsunit/web-snapshot/web-snapshot.js

@@ -20,7 +20,10 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   const r2 = Realm.create();
   const success = Realm.useWebSnapshot(r2, snapshot);
   assertTrue(success);
-  return Realm.eval(r2, use, { type: 'function', arguments: [exports] });
+  const result =
+      Realm.eval(r2, use, { type: 'function', arguments: [exports] });
+  %HeapObjectVerify(result);
+  return result;
 }
 
 (function TestMinimal() {