Bug 995675 - IonMonkey: Remove incorrect optimization of ToDouble, r=jandem

js/src/jit-test/tests/ion/bug995675.js

@@ -0,0 +1,5 @@
+function f(x) {
+        return Math.cos(~(~Math.pow(Number.MAX_VALUE, x)))
+}
+f(-0)
+assertEq(f(undefined - undefined), 1)

js/src/jit/MCallOptimize.cpp

@@ -586,13 +586,6 @@ IonBuilder::inlineMathAbs(CallInfo &callInfo)
     MInstruction *ins = MAbs::New(alloc(), callInfo.getArg(0), absType);
     current->add(ins);
 
-    if (IsFloatingPointType(argType) && returnType == MIRType_Int32) {
-        MToInt32 *toInt = MToInt32::New(alloc(), ins);
-        toInt->setCanBeNegativeZero(false);
-        current->add(toInt);
-        ins = toInt;
-    }
-
     current->push(ins);
     return InliningStatus_Inlined;
 }

js/src/jit/MIR.cpp

@@ -2328,12 +2328,6 @@ MToDouble::foldsTo(TempAllocator &alloc, bool useValueNumbers)
         }
     }
 
-    // Fold unnecessary numeric conversions.
-    if (input()->isToInt32()) {
-        replaceOperand(0, input()->getOperand(0));
-        conversion_ = NonStringPrimitives;
-    }
-
     return this;
 }