Migrated several tests from blink to V8 repository.

test/webkit/dfg-constant-fold-uncaptured-variable-that-is-later-captured.js

Index: test/webkit/dfg-constant-fold-uncaptured-variable-that-is-later-captured.js
diff --git a/test/webkit/concat-while-having-a-bad-time.js b/test/webkit/dfg-constant-fold-uncaptured-variable-that-is-later-captured.js
similarity index 53%
copy from test/webkit/concat-while-having-a-bad-time.js
copy to test/webkit/dfg-constant-fold-uncaptured-variable-that-is-later-captured.js
index dfda1e08a0b36194b787a44ee12a9693acd8aeaf..392f5fc8860e03f66705a7d15ac7268ecbc2b698 100644
--- a/test/webkit/concat-while-having-a-bad-time.js
+++ b/test/webkit/dfg-constant-fold-uncaptured-variable-that-is-later-captured.js
@@ -22,10 +22,31 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"Tests the behavior of Array.prototype.concat while the array is having a bad time due to one of the elements we are concatenating."
+"Tests that constant folding an access to an uncaptured variable that is captured later in the same basic block doesn't lead to assertion failures."
 );
 
-Object.defineProperty(Array.prototype, 0, { writable: false });
-shouldBe("[42].concat()", "[42]");
+var thingy = 456;
 
+function bar() {
+    return thingy;
+}
 
+function baz(a) {
+    if (a) // Here we have an access to r2. The bug was concerned with our assertions thinking that this access was invalid.
+        return arguments; // Force r2 (see below) to get captured.
+}
+
+function foo(p, a) {
+    // The temporary variable corresponding to the 'bar' callee coming out of the ternary expression will be allocated by
+    // the bytecompiler to some virtual register, say r2. This expression is engineered so that (1) the virtual register
+    // chosen for the callee here is the same as the one that will be chosen for the first non-this argument below,
+    // (2) that the callee ends up being constant but requires CFA to prove it, and (3) that we actually load that constant
+    // using GetLocal (which happens because of the CheckFunction to check the callee).
+    var x = (a + 1) + (p ? bar : bar)();
+    // The temporary variable corresponding to the first non-this argument to baz will be allocated to the same virtual
+    // register (i.e. r2).
+    return baz(x);
+}
+
+for (var i = 0; i < 100; ++i)
+    shouldBe("foo(true, 5)[0]", "462");