Migrate crashing tests from blink repository.

test/webkit/string-replacement-outofmemory.js

Index: test/webkit/string-replacement-outofmemory.js
diff --git a/test/webkit/dfg-other-branch.js b/test/webkit/string-replacement-outofmemory.js
similarity index 73%
copy from test/webkit/dfg-other-branch.js
copy to test/webkit/string-replacement-outofmemory.js
index 6aa22dcc081d5cb1f61a5a2873677a76312cf27f..2b8e18a854110a7c81829b2ff1aa551435f294a2 100644
--- a/test/webkit/dfg-other-branch.js
+++ b/test/webkit/string-replacement-outofmemory.js
@@ -22,30 +22,20 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"This tests that speculating other on a branch does not corrupt state."
+'This tests that string replacement with a large replacement string causes an out-of-memory exception. See <a href="https://bugs.webkit.org/show_bug.cgi?id=102956">bug 102956</a> for more details.'
 );
 
-function foo(a) {
-    if (a.f)
-        return "yes";
-    else
-        return "no";
+function createStringWithRepeatedChar(c, multiplicity) {
+    while (c.length < multiplicity)
+        c += c;
+    c = c.substring(0, multiplicity);
+    return c;
 }
 
-function bar(a) {
-    return !a.f;
-}
-
-for (var i = 0; i < 100; ++i)
-    foo({f:void(0)});
-
-for (var i = 0; i < 10; ++i)
-    shouldBe("foo({f:i})", i ? "\"yes\"" : "\"no\"");
-
-for (var i = 0; i < 100; ++i)
-    bar({f:void(0)});
-
-for (var i = 0; i < 10; ++i)
-    shouldBe("bar({f:i})", i ? "false" : "true");
+var x = "1";
+var y = "2";
+x = createStringWithRepeatedChar(x, 1 << 12);
+y = createStringWithRepeatedChar(y, (1 << 20) + 1);
 
+shouldThrow("x.replace(/\\d/g, y)", '"Error: Out of memory"');
 var successfullyParsed = true;