Guard against allocation top overflow in ObjectArray_Allocate intrinsic.

runtime/vm/intrinsifier_ia32.cc

Index: runtime/vm/intrinsifier_ia32.cc
diff --git a/runtime/vm/intrinsifier_ia32.cc b/runtime/vm/intrinsifier_ia32.cc
index fa1620561558faa4290270f8f7472abd2588a7c6..dc97d2658ddfe44b9ef69073477fb890c812d3f5 100644
--- a/runtime/vm/intrinsifier_ia32.cc
+++ b/runtime/vm/intrinsifier_ia32.cc
@@ -58,9 +58,12 @@ bool Intrinsifier::ObjectArray_Allocate(Assembler* assembler) {
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
-  // EDI: allocation size.
   __ movl(EAX, Address::Absolute(heap->TopAddress()));
-  __ leal(EBX, Address(EAX, EDI, TIMES_1, 0));
+  __ movl(EBX, EAX);
+
+  // EDI: allocation size.
+  __ addl(EBX, EDI);
+  __ j(CARRY, &fall_through);
 
   // Check if the allocation fits into the remaining space.
   // EAX: potential new object start.
@@ -226,6 +229,11 @@ bool Intrinsifier::Array_setIndexed(Assembler* assembler) {
   // Index not Smi.
   __ j(NOT_ZERO, &fall_through, Assembler::kNearJump);
   __ movl(EAX, Address(ESP, + 3 * kWordSize));  // Array.
+  __ CompareClassId(EAX, kArrayCid, EDI);

[Ivan Posva, 2012/09/12 21:26:34]

?

+  Label ok;
+  __ j(EQUAL, &ok);
+  __ int3();
+  __ Bind(&ok);
   // Range check.
   __ cmpl(EBX, FieldAddress(EAX, Array::length_offset()));
   // Runtime throws exception.
@@ -376,6 +384,11 @@ bool Intrinsifier::GrowableArray_setIndexed(Assembler* assembler) {
   Label fall_through;
   __ movl(EBX, Address(ESP, + 2 * kWordSize));  // Index.
   __ movl(EAX, Address(ESP, + 3 * kWordSize));  // GrowableArray.
+  __ CompareClassId(EAX, kGrowableObjectArrayCid, EDI);
+  Label ok;
+  __ j(EQUAL, &ok);
+  __ int3();
+  __ Bind(&ok);
   __ testl(EBX, Immediate(kSmiTagMask));
   __ j(NOT_ZERO, &fall_through, Assembler::kNearJump);  // Non-smi index.
   // Range check using _length field.