[liftoff] Add a regression test for msan failures

This test was generated following instructions in
https://crbug.com/1026680#c4, it seg faults with
https://crrev.com/c/1922489 and passes with the reland
https://crrev.com/c/1925131.

Bug: chromium:1026680
Change-Id: Ia8ef9878c06c50adeaa1a441524b5555b6869f97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930604
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65128}

test/mjsunit/regress/wasm/regress-1026680.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+  builder.addType(makeSig([], []));
+  // Generate function 1 (out of 2).
+  builder.addFunction(undefined, 0 /* sig */)
+    .addBodyWithEnd([
+// signature: i_iii
+// body:
+kExprCallFunction, 0x01, // function #1: v_v
+kExprI32Const, 0x00,
+kExprEnd,   // @5
+            ]);
+  // Generate function 2 (out of 2).
+  builder.addFunction(undefined, 1 /* sig */)
+    .addLocals({f32_count: 1}).addLocals({i32_count: 13})
+    .addBodyWithEnd([
+// signature: v_v
+// body:
+kExprEnd,   // @5
+            ]);
+  builder.addExport('main', 0);
+  const instance = builder.instantiate();
+  print(instance.exports.main(1, 2, 3));
+})();