Migrated several tests from blink to V8 repository.

test/webkit/dfg-float32-array-nan.js

Index: test/webkit/dfg-float32-array-nan.js
diff --git a/test/webkit/concat-while-having-a-bad-time.js b/test/webkit/dfg-float32-array-nan.js
similarity index 76%
copy from test/webkit/concat-while-having-a-bad-time.js
copy to test/webkit/dfg-float32-array-nan.js
index dfda1e08a0b36194b787a44ee12a9693acd8aeaf..4a62f40f0dffb851e38f3521e462f91081e4b584 100644
--- a/test/webkit/concat-while-having-a-bad-time.js
+++ b/test/webkit/dfg-float32-array-nan.js
@@ -22,10 +22,24 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"Tests the behavior of Array.prototype.concat while the array is having a bad time due to one of the elements we are concatenating."
+"Tests what happens in the DFG JIT if we load from a Float32 array that contains a weirdly formatted NaN."
 );
 
-Object.defineProperty(Array.prototype, 0, { writable: false });
-shouldBe("[42].concat()", "[42]");
+var buffer = new ArrayBuffer(4);
 
+var int32View = new Int32Array(buffer);
+var floatView = new Float32Array(buffer);
 
+int32View[0] = -4587521;
+
+debug(int32View[0]);
+
+function foo(o) {
+    debug(o[0]);
+    return o[0];
+}
+
+for (var i = 0; i < 100; ++i)
+    shouldBe("\"\" + foo(floatView)", "\"NaN\"");
+
+debug("I didn't crash, which is a good thing.");