Migrated several tests from blink to V8 repository.

test/webkit/dfg-get-by-val-clobber.js

Index: test/webkit/dfg-get-by-val-clobber.js
diff --git a/test/webkit/concat-while-having-a-bad-time.js b/test/webkit/dfg-get-by-val-clobber.js
similarity index 65%
copy from test/webkit/concat-while-having-a-bad-time.js
copy to test/webkit/dfg-get-by-val-clobber.js
index dfda1e08a0b36194b787a44ee12a9693acd8aeaf..c6c57fe3de965167353cd99c1c434a9ce1ba16c2 100644
--- a/test/webkit/concat-while-having-a-bad-time.js
+++ b/test/webkit/dfg-get-by-val-clobber.js
@@ -22,10 +22,31 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"Tests the behavior of Array.prototype.concat while the array is having a bad time due to one of the elements we are concatenating."
+"This tests that common subexpression elimination knows how to accurately model PutBuVal."
 );
 
-Object.defineProperty(Array.prototype, 0, { writable: false });
-shouldBe("[42].concat()", "[42]");
+function doAccesses(a, b, i, j, y) {
+    var x = a[i];
+    b[j] = y;
+    return a[i];
+}
 
+var array1 = [1, 2, 3, 4];
+var array2 = [5, 6, 7, 8];
+
+for (var i = 0; i < 1000; ++i) {
+    // Simple test, pretty easy to pass.
+    shouldBe("doAccesses(array1, array2, i % 4, (i + 1) % 4, i)", "" + ((i % 4) + 1));
+    shouldBe("array2[" + ((i + 1) % 4) + "]", "" + i);
+
+    // Undo.
+    array2[((i + 1) % 4)] = (i % 4) + 5;
+
+    // Now the evil test. This is constructed to minimize the likelihood that CSE will succeed through
+    // cleverness alone.
+    shouldBe("doAccesses(array1, array1, i % 4, 0, i)", "" + ((i % 4) == 0 ? i : (i % 4) + 1));
+
+    // Undo.
+    array1[0] = 1;
+}