Fix a bug in intrinsified Array_setIndexed type check.

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 181 matching lines @@
 static bool Array_setIndexed(Assembler* assembler) {
   if (FLAG_enable_type_checks) {
     return false;
   }
   const Immediate raw_null =
       Immediate(reinterpret_cast<intptr_t>(Object::null()));
   Label fall_through;
   __ movl(EAX, Address(ESP, + 1 * kWordSize));  // Value.
   __ movl(EBX, Address(ESP, + 2 * kWordSize));  // Index.
   __ orl(EAX, EBX);
-  __ testl(EBX, Immediate(kSmiTagMask));
+  __ testl(EAX, Immediate(kSmiTagMask));

[siva, 2011/12/20 01:38:00]

Is there a unit test which exposes this bug and validates the fix?

[srdjan, 2011/12/20 02:06:33]

It is difficult to test, since the only thing it does is skip the store check.

   // Value or index not Smi.
   __ j(NOT_ZERO, &fall_through, Assembler::kNearJump);
   __ movl(EAX, Address(ESP, + 3 * kWordSize));  // Array.
   // Range check.
   __ cmpl(EBX, FieldAddress(EAX, Array::length_offset()));
   // Runtime throws exception.
   __ j(ABOVE_EQUAL, &fall_through, Assembler::kNearJump);
   // Note that EBX is Smi, i.e, times 2.
   ASSERT(kSmiTagShift == 1);
   // Destroy ECX as we will not continue in the function.
@@ skipping 794 matching lines @@
   }                                                                            \
 
 INTRINSIC_LIST(FIND_INTRINSICS);
 #undef FIND_INTRINSICS
   return false;
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32