Guard against allocation top overflow in ObjectArray_Allocate intrinsic.

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 40 matching lines @@
   __ cmpl(EDI, max_len);
   __ j(GREATER, &fall_through);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ leal(EDI, Address(EDI, TIMES_2, fixed_size));  // EDI is a Smi.
   ASSERT(kSmiTagShift == 1);
   __ andl(EDI, Immediate(-kObjectAlignment));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
+  __ movl(EAX, Address::Absolute(heap->TopAddress()));
+  __ movl(EBX, EAX);
+
   // EDI: allocation size.
-  __ movl(EAX, Address::Absolute(heap->TopAddress()));
-  __ leal(EBX, Address(EAX, EDI, TIMES_1, 0));
+  __ addl(EBX, EDI);
+  __ j(CARRY, &fall_through);
 
   // Check if the allocation fits into the remaining space.
   // EAX: potential new object start.
   // EBX: potential next object start.
   // EDI: allocation size.
   __ cmpl(EBX, Address::Absolute(heap->EndAddress()));
   __ j(ABOVE_EQUAL, &fall_through);
 
   // Successfully allocated the object(s), now update top to point to
   // next object start and initialize the object.
@@ skipping 145 matching lines @@
     __ j(EQUAL,  &checked_ok, Assembler::kNearJump);
     __ CompareObject(EAX, Type::ZoneHandle(Type::Number()));
     __ j(NOT_EQUAL, &fall_through, Assembler::kNearJump);
     __ Bind(&checked_ok);
   }
   __ movl(EBX, Address(ESP, + 2 * kWordSize));  // Index.
   __ testl(EBX, Immediate(kSmiTagMask));
   // Index not Smi.
   __ j(NOT_ZERO, &fall_through, Assembler::kNearJump);
   __ movl(EAX, Address(ESP, + 3 * kWordSize));  // Array.
+  __ CompareClassId(EAX, kArrayCid, EDI);

[Ivan Posva, 2012/09/12 21:26:34]

?

+  Label ok;
+  __ j(EQUAL, &ok);
+  __ int3();
+  __ Bind(&ok);
   // Range check.
   __ cmpl(EBX, FieldAddress(EAX, Array::length_offset()));
   // Runtime throws exception.
   __ j(ABOVE_EQUAL, &fall_through, Assembler::kNearJump);
   // Note that EBX is Smi, i.e, times 2.
   ASSERT(kSmiTagShift == 1);
   // Destroy ECX as we will not continue in the function.
   __ movl(ECX, Address(ESP, + 1 * kWordSize));  // Value.
   __ StoreIntoObject(EAX,
                      FieldAddress(EAX, EBX, TIMES_2, sizeof(RawArray)),
@@ skipping 130 matching lines @@
 
 // Set value into growable object array at specified index.
 // On stack: growable array (+3), index (+2), value (+1), return-address (+0).
 bool Intrinsifier::GrowableArray_setIndexed(Assembler* assembler) {
   if (FLAG_enable_type_checks) {
     return false;
   }
   Label fall_through;
   __ movl(EBX, Address(ESP, + 2 * kWordSize));  // Index.
   __ movl(EAX, Address(ESP, + 3 * kWordSize));  // GrowableArray.
+  __ CompareClassId(EAX, kGrowableObjectArrayCid, EDI);
+  Label ok;
+  __ j(EQUAL, &ok);
+  __ int3();
+  __ Bind(&ok);
   __ testl(EBX, Immediate(kSmiTagMask));
   __ j(NOT_ZERO, &fall_through, Assembler::kNearJump);  // Non-smi index.
   // Range check using _length field.
   __ cmpl(EBX, FieldAddress(EAX, GrowableObjectArray::length_offset()));
   // Runtime throws exception.
   __ j(ABOVE_EQUAL, &fall_through, Assembler::kNearJump);
   __ movl(EAX, FieldAddress(EAX, GrowableObjectArray::data_offset()));  // data.
   __ movl(EDI, Address(ESP, + 1 * kWordSize));  // Value.
   // Note that EBX is Smi, i.e, times 2.
   ASSERT(kSmiTagShift == 1);
@@ skipping 1034 matching lines @@
   __ Bind(&is_true);
   __ LoadObject(EAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32