Add regression test for http://crbug/1206289

Bug: chromium:1206289
Change-Id: Ib0cc2a0d159b763efa4fe33502b0a6562973b430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429501Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78899}

test/mjsunit/regress/regress-crbug-1206289.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --stress-flush-bytecode
+
+function outer() {
+  function asm_broken(a, import_obj) {
+    "use asm";
+    // import_obj is expected to be an object and this causes
+    // asm_wasm_broken to be set to true when instantiating at runtime.
+    var v = import_obj.x;
+    function inner() {
+    }
+    return inner;
+  }
+  var m = asm_broken();
+}
+
+assertThrows(outer);
+gc();
+assertThrows(outer);