[JSC] DFG should preserve ToNumber side-effect for Math.pow with one argument

https://bugs.webkit.org/show_bug.cgi?id=309541

Reviewed by Justin Michaud.

When Math.pow(x) is called with a single argument, DFG ByteCodeParser
unconditionally folds it to a NaN constant and drops the argument
entirely. However, the runtime implementation (mathProtoFuncPow) always
calls argument(0).toNumber(), which has observable side effects:
valueOf/Symbol.toPrimitive invocations, or throwing TypeError for
Symbol/BigInt.

This causes tier-inconsistent behavior: before DFG tier-up, valueOf is
invoked on every call; after tier-up, the side effect silently
disappears.

Fix by splitting the < 3 argument check: for the 1-argument case, emit
a Phantom with NumberUse edge on the argument before returning NaN.
This forces OSR exit when a non-number is passed, falling back to
baseline where ToNumber runs correctly. This mirrors the existing
pattern in handleMinMax for Math.max(x)/Math.min(x).

Test: JSTests/stress/math-pow-one-argument-to-number.js

* JSTests/stress/math-pow-one-argument-to-number.js: Added.
(shouldBe):
(let.obj.valueOf):
(test):
(testThrow):
(let.throwObj.valueOf):
(catch):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

Canonical link: https://commits.webkit.org/308954@main

Author: sosukesuzuki

JSTests/stress/math-pow-one-argument-to-number.js

@@ -0,0 +1,38 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`expected ${expected} but got ${actual}`);
+}
+
+let counter = 0;
+let obj = { valueOf() { counter++; return 1; } };
+
+function test(x) {
+    return Math.pow(x);
+}
+noInline(test);
+
+for (let i = 0; i < testLoopCount; i++)
+    shouldBe(Number.isNaN(test(obj)), true);
+
+shouldBe(counter, testLoopCount);
+
+for (let i = 0; i < testLoopCount; i++)
+    shouldBe(Number.isNaN(test(42)), true);
+
+function testThrow(x) {
+    return Math.pow(x);
+}
+noInline(testThrow);
+
+for (let i = 0; i < testLoopCount; i++)
+    shouldBe(Number.isNaN(testThrow(1.5)), true);
+
+let throwObj = { valueOf() { throw new Error("ok"); } };
+let caught = false;
+try {
+    testThrow(throwObj);
+} catch (e) {
+    caught = true;
+    shouldBe(e.message, "ok");
+}
+shouldBe(caught, true);

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -2630,9 +2630,16 @@ auto ByteCodeParser::handleIntrinsicCall(Node* callee, Operand resultOperand, Ca
         }
 
         case PowIntrinsic: {
-            if (argumentCountIncludingThis < 3) {
-                // Math.pow() and Math.pow(x) return NaN.
+            if (argumentCountIncludingThis == 1) {
+                // Math.pow() returns NaN.
+                insertChecks();
+                setResult(addToGraph(JSConstant, OpInfo(m_constantNaN)));
+                return CallOptimizationResult::Inlined;
+            }
+            if (argumentCountIncludingThis == 2) {
+                // Math.pow(x) returns NaN, but ToNumber(x) may have side effects.
                 insertChecks();
+                addToGraph(Phantom, Edge(get(virtualRegisterForArgumentIncludingThis(1, registerOffset)), NumberUse));
                 setResult(addToGraph(JSConstant, OpInfo(m_constantNaN)));
                 return CallOptimizationResult::Inlined;
             }