[test] add mjsunit regression tests for v8:6322

A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}

test/mjsunit/es6/regress/regress-6322.js

@@ -4,3 +4,8 @@
 
 // Crash with --verify-heap
 (function*() { for (let { a = class b { } } of [{}]) { } })().next();
+(function() { for (let { a = class b { } } of [{}]) { } })();
+(function() { var a; for ({ a = class b { } } of [{}]) { } })();
+
+(function() { for (let [a = class b { } ] = [[]]; ;) break; })();
+(function() { var a; for ([a = class b { } ] = [[]]; ;) break; })();

test/mjsunit/harmony/regress/regress-6322.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-iteration
+
+// Crash with --verify-heap
+(async function() { for await (let { a = class b { } } of [{}]) { } })();
+(async function() { var a; for await ({ a = class b { } } of [{}]) { } })();