Fix crashes in intrinsified float32/float64 array setters when attempting to store a Smi. Added tes…

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 588 matching lines @@
   __ Bind(&fall_through);
 
   return false;
 }
 
 
 bool Intrinsifier::Float32Array_setIndexed(Assembler* assembler) {
   Label fall_through;
   __ movl(EAX, Address(ESP, + 1 * kWordSize));  // Value.
   // If EAX is not an instance of double, jump to fall through.
+  __ testl(EAX, Immediate(kSmiTagMask));
+  __ j(ZERO, &fall_through);
   __ CompareClassId(EAX, kDoubleCid, EDI);
-  __ j(NOT_EQUAL, &fall_through);
+  __ j(NOT_EQUAL, &fall_through, Assembler::kNearJump);
   // Load double value into XMM7.
   __ movsd(XMM7, FieldAddress(EAX, Double::value_offset()));
   TestByteArraySetIndex(assembler, &fall_through);
   // After TestByteArraySetIndex:
   // * EAX has the base address of the byte array.
   // * EBX has the index into the array.
   // EBX contains the SMI index which is shifted by 1.
   // This shift means we only multiply the index by 2 not 4 (sizeof float).
   // Convert from double precision float to single precision float.
   __ cvtsd2ss(XMM7, XMM7);
@@ skipping 29 matching lines @@
   __ ret();
   __ Bind(&fall_through);
   return false;
 }
 
 
 bool Intrinsifier::Float64Array_setIndexed(Assembler* assembler) {
   Label fall_through;
   __ movl(EAX, Address(ESP, + 1 * kWordSize));  // Value.
   // If EAX is not an instance of double, jump to fall through.
+  __ testl(EAX, Immediate(kSmiTagMask));
+  __ j(ZERO, &fall_through, Assembler::kNearJump);
   __ CompareClassId(EAX, kDoubleCid, EDI);
-  __ j(NOT_EQUAL, &fall_through);
+  __ j(NOT_EQUAL, &fall_through, Assembler::kNearJump);
   // Load double value into XMM7.
   __ movsd(XMM7, FieldAddress(EAX, Double::value_offset()));
   TestByteArraySetIndex(assembler, &fall_through);
   // After TestByteArraySetIndex:
   // * EAX has the base address of the byte array.
   // * EBX has the index into the array.
   // EBX contains the SMI index which is shifted by 1.
   // This shift means we only multiply the index by 4 not 8 (sizeof float).
   // Store into array.
   __ movsd(FieldAddress(EAX, EBX, TIMES_4, Float64Array::data_offset()), XMM7);
@@ skipping 874 matching lines @@
   __ Bind(&is_true);
   __ LoadObject(EAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32