Migrated several tests from blink to V8 repository.

test/webkit/dfg-int32-to-double-on-set-local-and-sometimes-exit.js

Index: test/webkit/dfg-int32-to-double-on-set-local-and-sometimes-exit.js
diff --git a/test/webkit/concat-while-having-a-bad-time.js b/test/webkit/dfg-int32-to-double-on-set-local-and-sometimes-exit.js
similarity index 60%
copy from test/webkit/concat-while-having-a-bad-time.js
copy to test/webkit/dfg-int32-to-double-on-set-local-and-sometimes-exit.js
index dfda1e08a0b36194b787a44ee12a9693acd8aeaf..532198e2513b57a99d35e36c6599071179337bab 100644
--- a/test/webkit/concat-while-having-a-bad-time.js
+++ b/test/webkit/dfg-int32-to-double-on-set-local-and-sometimes-exit.js
@@ -22,10 +22,44 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"Tests the behavior of Array.prototype.concat while the array is having a bad time due to one of the elements we are concatenating."
+"Tests that an Int32ToDouble placed on a SetLocal does a forward exit, and works right even when the relevant variable is actually predicted numeric."
 );
 
-Object.defineProperty(Array.prototype, 0, { writable: false });
-shouldBe("[42].concat()", "[42]");
+var counter = 0;
 
+function checkpoint(text) {
+    debug("Checkpoint: " + text);
+    counter++;
+}
 
+function func1() {
+    checkpoint("a");
+    a = Date.now() + Date.now() + Date.now() + Date.now() + Date.now() + Date.now();
+    checkpoint("b");
+    if (counter < 1100)
+        return 0;
+}
+function func2() {
+    checkpoint("c");
+    return Date.now() + Date.now() + Date.now() + Date.now() + Date.now() + Date.now();
+}
+
+function func3(s) {
+    checkpoint("1");
+    s = func1(); // The bug is that this function will be called twice, if our Int32ToDouble hoisting does a backward speculation.
+    checkpoint("2");
+    s = func2();
+    checkpoint("3");
+    return s;
+}
+
+function test() {
+    return func3(1);
+}
+
+
+for (var i=0; i < 200; i++) {
+    test();
+}
+
+shouldBe("counter", "1200");