Fix crashes in intrinsified float32/float64 array setters when attempting to store a Smi. Added tes…

runtime/vm/intrinsifier_x64.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 552 matching lines @@
 bool Intrinsifier::Float32Array_setIndexed(Assembler* assembler) {
   Label fall_through;
   TestByteArraySetIndex(assembler, &fall_through);
   // After TestByteArraySetIndex:
   // * RAX has the base address of the byte array.
   // * R12 has the index into the array.
   // R12 contains the SMI index which is shifted by 1.
   // This shift means we only multiply the index by 2 not 4 (sizeof float).
   __ movq(RDX, Address(RSP, + 1 * kWordSize));  // Value.
   // If RDX is not an instance of double, jump to fall through.
+  __ testq(RDX, Immediate(kSmiTagMask));
+  __ j(ZERO, &fall_through, Assembler::kNearJump);
   __ CompareClassId(RDX, kDoubleCid);
-  __ j(NOT_EQUAL, &fall_through);
+  __ j(NOT_EQUAL, &fall_through, Assembler::kNearJump);
   // Load double value into XMM7.
   __ movsd(XMM7, FieldAddress(RDX, Double::value_offset()));
   // Convert from double precision float to single precision float.
   __ cvtsd2ss(XMM7, XMM7);
   // Store into array.
   __ movss(FieldAddress(RAX, R12, TIMES_2, Float32Array::data_offset()), XMM7);
   // End fast path.
   __ ret();
   __ Bind(&fall_through);
   return false;
@@ skipping 29 matching lines @@
 bool Intrinsifier::Float64Array_setIndexed(Assembler* assembler) {
   Label fall_through;
   TestByteArraySetIndex(assembler, &fall_through);
   // After TestByteArraySetIndex:
   // * RAX has the base address of the byte array.
   // * R12 has the index into the array.
   // R12 contains the SMI index which is shifted by 1.
   // This shift means we only multiply the index by 4 not 8 (sizeof double).
   __ movq(RDX, Address(RSP, + 1 * kWordSize));  // Value.
   // If RDX is not an instance of double, jump to fall through.
+  __ testq(RDX, Immediate(kSmiTagMask));
+  __ j(ZERO, &fall_through, Assembler::kNearJump);
   __ CompareClassId(RDX, kDoubleCid);
-  __ j(NOT_EQUAL, &fall_through);
+  __ j(NOT_EQUAL, &fall_through, Assembler::kNearJump);
   // Load double value into XMM7.
   __ movsd(XMM7, FieldAddress(RDX, Double::value_offset()));
   // Store into array.
   __ movsd(FieldAddress(RAX, R12, TIMES_4, Float64Array::data_offset()), XMM7);
   __ ret();
   __ Bind(&fall_through);
   return false;
 }
 
 
@@ skipping 864 matching lines @@
   __ LoadObject(RAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64