[wasm] Add missing WebAssembly.instantiate regression test.

R=titzer@chromium.org
TEST=mjsunit/regress/wasm/regress-799952
BUG=chromium:799952

Change-Id: Idb4a1938cc04f2f5b1ea33ba390c5917fea2c0c1
Reviewed-on: https://chromium-review.googlesource.com/1075967Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53402}

test/mjsunit/regress/wasm/regress-799952.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sentinel = {};
+Object.defineProperty(Promise, Symbol.species, {
+  value: function(f) {
+    f(function() {}, function() {})
+    return sentinel;
+  }
+});
+
+// According to the WebAssembly JavaScript API spec, WebAssembly.instantiate is
+// using the initial value of the Promise constructor. Specifically it ignores
+// the Promise species constructor installed above.
+var promise = WebAssembly.instantiate(new ArrayBuffer());
+assertInstanceof(promise, Promise);
+assertNotSame(promise, sentinel);
+
+// All further uses of the returned Promise, like using Promise.prototype.then,
+// will respect the Promise species constructor installed above however.
+var monkey = promise.then(r => { print(r) }, e => { print(e) });
+assertSame(monkey, sentinel);