Change compiler to safely write unsafe smis when they are spilled from...

src/codegen-ia32.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 446 matching lines @@
   void ToBoolean(ControlDestination* destination);
 
   void GenericBinaryOperation(Token::Value op,
       StaticType* type,
       const OverwriteMode overwrite_mode = NO_OVERWRITE);
 
   void Comparison(Condition cc,
                   bool strict,
                   ControlDestination* destination);
 
-  // Inline small integer literals. To prevent long attacker-controlled byte
-  // sequences, we only inline small Smis.
+  // To prevent long attacker-controlled byte sequences, integer constants
+  // from the JavaScript source are loaded in two parts if they are larger
+  // than 16 bits.
   static const int kMaxSmiInlinedBits = 16;
+  bool IsUnsafeSmi(Handle<Object> value);
+  // Load an integer constant x into a register target using
+  // at most 16 bits of user-controlled data per assembly operation.
+  void LoadUnsafeSmi(Register target, Handle<Object> value);
+
   bool IsInlineSmi(Literal* literal);
   void SmiComparison(Condition cc,  Handle<Object> value, bool strict);
   void SmiOperation(Token::Value op,
                     StaticType* type,
                     Handle<Object> value,
                     bool reversed,
                     OverwriteMode overwrite_mode);
 
   void CallWithArguments(ZoneList<Expression*>* arguments, int position);
 
@@ skipping 128 matching lines @@
 
   // True when we are in code that expects the virtual frame to be fully
   // spilled.  Some virtual frame function are disabled in DEBUG builds when
   // called from spilled code, because they do not leave the virtual frame
   // in a spilled state.
   bool in_spilled_code_;
 
   friend class VirtualFrame;
   friend class JumpTarget;
   friend class Reference;
+  friend class Result;
 
   DISALLOW_COPY_AND_ASSIGN(CodeGenerator);
 };
 
 
 void Reference::GetValueAndSpill(TypeofState typeof_state) {
   ASSERT(cgen_->in_spilled_code());
   cgen_->set_in_spilled_code(false);
   GetValue(typeof_state);
   cgen_->frame()->SpillAll();
   cgen_->set_in_spilled_code(true);
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_CODEGEN_IA32_H_