DFG initrinsic handling should ensure that we backwards propagate the fact that all operands may escape
https://bugs.webkit.org/show_bug.cgi?id=106365

Source/JavaScriptCore: 

Reviewed by Mark Hahnenberg.
        
Use the fact that Phantom means that things escaped, and just insert Phantoms for all
of the operands.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleCall):

LayoutTests: 

Reviewed by Mark Hahnenberg.
        
Add tests that cover the possible badness that could occur for all of those
intrinsics that don't intrinsically (pun sort of intended) cause escapeage
to happen. As in, if we did happen to know for sure that what we want is
ArithSqrt, then we would have a guarantee that ArithSqrt does not by itself
use its operands in a way that involves NodeUsedAsOther. But when ArithSqrt
is inserted because of intrinsic optimization (i.e. something like
Math.sqrt(blah)) then the intrinsic machinery needs to indicate that blah
could escape in the case that we didn't end up doing ArithSqrt because we
exited prior to it and called some other function.

* fast/js/dfg-abs-backwards-propagation-expected.txt: Added.
* fast/js/dfg-abs-backwards-propagation.html: Added.
* fast/js/dfg-max-backwards-propagation-expected.txt: Added.
* fast/js/dfg-max-backwards-propagation.html: Added.
* fast/js/dfg-min-backwards-propagation-expected.txt: Added.
* fast/js/dfg-min-backwards-propagation.html: Added.
* fast/js/dfg-proven-sqrt-backwards-propagation-expected.txt: Added.
* fast/js/dfg-proven-sqrt-backwards-propagation.html: Added.
* fast/js/dfg-sqrt-backwards-propagation-expected.txt: Added.
* fast/js/dfg-sqrt-backwards-propagation.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-abs-backwards-propagation.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-max-backwards-propagation.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-min-backwards-propagation.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-proven-sqrt-backwards-propagation.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-sqrt-backwards-propagation.js: Added.
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139098 268f45cc-cd09-0410-ab3c-d52691b4dbfc