Fix truncate divide bug (reported by sra) when dividing MIN_SMI by -1.

vm/intrinsifier_ia32.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 350 matching lines @@
 static bool Integer_truncDivide(Assembler* assembler) {
   Label fall_through;
   TestBothArgumentsSmis(assembler, &fall_through);
   // EAX: right argument (divisor)
   __ cmpl(EAX, Immediate(0));
   __ j(EQUAL, &fall_through, Assembler::kNearJump);
   __ movl(EBX, EAX);
   __ SmiUntag(EBX);
   __ movl(EAX, Address(ESP, + 2 * kWordSize));  // Left argument (dividend).
   __ SmiUntag(EAX);
+  __ pushl(EDX);  // Preserve EDX in case of 'fall_through'.
   __ cdq();
   __ idivl(EBX);
+  __ popl(EDX);
+  // Check the corner case of dividing the 'MIN_SMI' with -1, in which case we
+  // cannot tag the result.
+  __ cmpl(EAX, Immediate(0x40000000));
+  __ j(EQUAL, &fall_through);
   __ SmiTag(EAX);
   __ ret();
   __ Bind(&fall_through);
   return false;
 }
 
 
 static bool Integer_negate(Assembler* assembler) {
   Label fall_through;
   __ movl(EAX, Address(ESP, + 1 * kWordSize));
@@ skipping 618 matching lines @@
   }                                                                            \
 
 INTRINSIC_LIST(FIND_INTRINSICS);
 #undef FIND_INTRINSICS
   return false;
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32