From: bmeurer <bmeurer@chromium.org>
Date: Tue, 25 Aug 2015 06:24:40 +0000 (-0700)
Subject: [crankshaft] DCE must not eliminate (observable) math operations.
X-Git-Tag: upstream/4.7.83~697
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=fef38c21e8e119e3bbf5423fd6fc2c03fd1f6c39;p=platform%2Fupstream%2Fv8.git

[crankshaft] DCE must not eliminate (observable) math operations.

The HUnaryMathOperation cannot be eliminated in general, because the
spec requires a ToNumber conversion on the input, which is observable
of course.

BUG=v8:4389
LOG=y

Review URL: https://codereview.chromium.org/1307413003

Cr-Commit-Position: refs/heads/master@{#30343}
---

diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 077e916..ddcf21a 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -2635,7 +2635,12 @@ class HUnaryMathOperation final : public HTemplateInstruction<2> {
     SetFlag(kAllowUndefinedAsNaN);
   }
 
-  bool IsDeletable() const override { return true; }
+  bool IsDeletable() const override {
+    // TODO(crankshaft): This should be true, however the semantics of this
+    // instruction also include the ToNumber conversion that is mentioned in the
+    // spec, which is of course observable.
+    return false;
+  }
 
   HValue* SimplifiedDividendForMathFloorOfDiv(HDiv* hdiv);
   HValue* SimplifiedDivisorForMathFloorOfDiv(HDiv* hdiv);
diff --git a/test/mjsunit/compiler/regress-4389-1.js b/test/mjsunit/compiler/regress-4389-1.js
new file mode 100644
index 0000000..c58ce2d
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-1.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.fround(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-2.js b/test/mjsunit/compiler/regress-4389-2.js
new file mode 100644
index 0000000..3b720a5
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-2.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.sqrt(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-3.js b/test/mjsunit/compiler/regress-4389-3.js
new file mode 100644
index 0000000..9aa72d1
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-3.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.floor(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-4.js b/test/mjsunit/compiler/regress-4389-4.js
new file mode 100644
index 0000000..e824973
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-4.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.round(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-5.js b/test/mjsunit/compiler/regress-4389-5.js
new file mode 100644
index 0000000..64797bc
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-5.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.abs(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);
diff --git a/test/mjsunit/compiler/regress-4389-6.js b/test/mjsunit/compiler/regress-4389-6.js
new file mode 100644
index 0000000..fe06570
--- /dev/null
+++ b/test/mjsunit/compiler/regress-4389-6.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.log(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);