[crankshaft] DCE must not eliminate (observable) math operations.

The HUnaryMathOperation cannot be eliminated in general, because the
spec requires a ToNumber conversion on the input, which is observable
of course.

BUG=v8:4389
LOG=y

Review URL: https://codereview.chromium.org/1307413003

Cr-Commit-Position: refs/heads/master@{#30343}

src/hydrogen-instructions.h

@@ -2635,7 +2635,12 @@ class HUnaryMathOperation final : public HTemplateInstruction<2> {
     SetFlag(kAllowUndefinedAsNaN);
   }
 
-  bool IsDeletable() const override { return true; }
+  bool IsDeletable() const override {
+    // TODO(crankshaft): This should be true, however the semantics of this
+    // instruction also include the ToNumber conversion that is mentioned in the
+    // spec, which is of course observable.
+    return false;
+  }
 
   HValue* SimplifiedDividendForMathFloorOfDiv(HDiv* hdiv);
   HValue* SimplifiedDivisorForMathFloorOfDiv(HDiv* hdiv);

test/mjsunit/compiler/regress-4389-1.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.fround(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);

test/mjsunit/compiler/regress-4389-2.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.sqrt(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);

test/mjsunit/compiler/regress-4389-3.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.floor(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);

test/mjsunit/compiler/regress-4389-4.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.round(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);

test/mjsunit/compiler/regress-4389-5.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.abs(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);

test/mjsunit/compiler/regress-4389-6.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+function foo(x) { Math.log(x); }
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(Symbol()) }, TypeError);