Add exhaustive test for String.prototype.substr with various number inputs

[anba]

Also see: https://github.com/tc39/ecma262/pull/2844

[anba]

I wrote a SpiderMonkey patch which had an incorrect change to String.prototype.substr. Test262 didn't uncover the bug, only some other unrelated Firefox test triggered it. So I thought it's time to add a more exhaustive test for substr. :smile:

[ptomato]

I approved this a while ago, no other reviews after mine, and Jordan's comment has been addressed; I think we should merge it.