Migrated several tests from blink to V8 repository.

test/webkit/dfg-int-overflow-in-loop.js

Index: test/webkit/dfg-int-overflow-in-loop.js
diff --git a/test/webkit/concat-while-having-a-bad-time.js b/test/webkit/dfg-int-overflow-in-loop.js
similarity index 73%
copy from test/webkit/concat-while-having-a-bad-time.js
copy to test/webkit/dfg-int-overflow-in-loop.js
index dfda1e08a0b36194b787a44ee12a9693acd8aeaf..8752a12cbd469ef2cf1c0e0efd96acfdf4e6e737 100644
--- a/test/webkit/concat-while-having-a-bad-time.js
+++ b/test/webkit/dfg-int-overflow-in-loop.js
@@ -22,10 +22,19 @@
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 description(
-"Tests the behavior of Array.prototype.concat while the array is having a bad time due to one of the elements we are concatenating."
+"Tests that overflowing an integer in a loop and then only using it in an integer context produces a result that complies with double arithmetic."
 );
 
-Object.defineProperty(Array.prototype, 0, { writable: false });
-shouldBe("[42].concat()", "[42]");
+function foo(a) {
+    var x = a;
+    // Make sure that this is the loop where we do OSR entry.
+    for (var i = 0; i < 100000; ++i)
+        x += 1;
+    // Now trigger overflow that is so severe that the floating point result would be different than the bigint result.
+    for (var i = 0; i < 160097152; ++i)
+        x += 2147483647;
+    return x | 0;
+}
 
+shouldBe("foo(0)", "-4094336");