Fix String._substringUnchecked intrinsic on x64.

runtime/vm/intrinsifier_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 1764 matching lines @@
 
 // Arg0: OneByteString (receiver).
 // Arg1: Start index as Smi.
 // Arg2: End index as Smi.
 // The indexes must be valid.
 void Intrinsifier::OneByteString_substringUnchecked(Assembler* assembler) {
   const intptr_t kStringOffset = 3 * kWordSize;
   const intptr_t kStartIndexOffset = 2 * kWordSize;
   const intptr_t kEndIndexOffset = 1 * kWordSize;
   Label fall_through, ok;
-  __ movq(RSI, Address(RSP, + kEndIndexOffset));
+  __ movq(RSI, Address(RSP, + kStartIndexOffset));
   __ movq(RDI, Address(RSP, + kEndIndexOffset));
   __ orq(RSI, RDI);
   __ testq(RSI, Immediate(kSmiTagMask));
   __ j(NOT_ZERO, &fall_through);  // 'start', 'end' not Smi.
 
   __ subq(RDI, Address(RSP, + kStartIndexOffset));
   TryAllocateOnebyteString(assembler, &ok, &fall_through, RDI);
   __ Bind(&ok);
   // RAX: new string as tagged pointer.
   // Copy string.
@@ skipping 192 matching lines @@
   // Set return value to Isolate::current_tag_.
   __ movq(RAX, Address(RBX, Isolate::current_tag_offset()));
   __ ret();
 }
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64