Tests for GuardField length check along with bug fixes

runtime/vm/intermediate_language_x64.cc

Index: runtime/vm/intermediate_language_x64.cc
diff --git a/runtime/vm/intermediate_language_x64.cc b/runtime/vm/intermediate_language_x64.cc
index e3b321d01ddfe97e84a47dee3e5e6a45e52327ea..006c2d1ecab36c04dc2cebd61ebe9dfdb46b969a 100644
--- a/runtime/vm/intermediate_language_x64.cc
+++ b/runtime/vm/intermediate_language_x64.cc
@@ -1553,17 +1553,53 @@ void GuardFieldInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
           __ pushq(value_cid_reg);
           __ movq(value_cid_reg,
                   FieldAddress(value_reg, Array::length_offset()));
-          __ cmpq(value_cid_reg, Immediate(field_length));
+          __ cmpq(value_cid_reg, Immediate(Smi::RawValue(field_length)));
           __ popq(value_cid_reg);
         } else if (RawObject::IsTypedDataClassId(field_cid)) {
           __ pushq(value_cid_reg);
           __ movq(value_cid_reg,
                   FieldAddress(value_reg, TypedData::length_offset()));
-          __ cmpq(value_cid_reg, Immediate(field_length));
+          __ cmpq(value_cid_reg, Immediate(Smi::RawValue(field_length)));
           __ popq(value_cid_reg);
         } else {
           ASSERT(field_cid == kIllegalCid);
-          // Following jump cannot not occur, fall through.
+          ASSERT(field_length == Field::kUnknownFixedLength);
+          // At compile time we do not know the type of the field nor its
+          // length. At execution time we may have set the class id and
+          // list length so we compare the guarded length with the
+          // list length here, without this check the list length could change
+          // without triggering a deoptimization.
+          Label check_array, length_compared, no_fixed_length;
+          __ cmpq(value_cid_reg, Immediate(kNullCid));
+          __ j(EQUAL, &no_fixed_length, Assembler::kNearJump);
+          // Check for typed data array.
+          __ cmpq(value_cid_reg, Immediate(kTypedDataFloat32x4ArrayCid));
+          // Not a typed array or a regular array.
+          __ j(GREATER, &no_fixed_length, Assembler::kNearJump);
+          __ cmpq(value_cid_reg, Immediate(kTypedDataInt8ArrayCid));
+          // Could still be a regular array.
+          __ j(LESS, &check_array, Assembler::kNearJump);
+          __ pushq(value_cid_reg);
+          __ movq(value_cid_reg,
+                  FieldAddress(value_reg, TypedData::length_offset()));
+          __ cmpq(field_length_operand, value_cid_reg);
+          __ popq(value_cid_reg);
+          __ jmp(&length_compared, Assembler::kNearJump);
+          // Check for regular array.
+          __ Bind(&check_array);
+          __ cmpq(value_cid_reg, Immediate(kImmutableArrayCid));
+          __ j(GREATER, &no_fixed_length, Assembler::kNearJump);
+          __ cmpq(value_cid_reg, Immediate(kArrayCid));
+          __ j(LESS, &no_fixed_length, Assembler::kNearJump);
+          __ pushq(value_cid_reg);
+          __ movq(value_cid_reg,
+                  FieldAddress(value_reg, Array::length_offset()));
+          __ cmpq(field_length_operand, value_cid_reg);
+          __ popq(value_cid_reg);
+          __ jmp(&length_compared, Assembler::kNearJump);
+          __ Bind(&no_fixed_length);
+          __ jmp(fail);
+          __ Bind(&length_compared);
         }
         __ j(NOT_EQUAL, fail);
       }
@@ -1578,28 +1614,25 @@ void GuardFieldInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
       __ j(NOT_EQUAL, &skip_length_check);
       // Insert length check.
       if (field_has_length) {
-        if (value_cid_reg == kNoRegister) {
-          ASSERT(!compiler->is_optimizing());
-          value_cid_reg = RDX;
-          ASSERT((value_cid_reg != value_reg) && (field_reg != value_cid_reg));
-        }
         ASSERT(value_cid_reg != kNoRegister);
-        if ((field_cid == kArrayCid) || (field_cid == kImmutableArrayCid)) {
-          __ pushq(value_cid_reg);
-          __ movq(value_cid_reg,
-                  FieldAddress(value_reg, Array::length_offset()));
-          __ cmpq(value_cid_reg, Immediate(field_length));
-          __ popq(value_cid_reg);
-        } else if (RawObject::IsTypedDataClassId(field_cid)) {
-          __ pushq(value_cid_reg);
-          __ movq(value_cid_reg,
-                  FieldAddress(value_reg, TypedData::length_offset()));
-          __ cmpq(value_cid_reg, Immediate(field_length));
-          __ popq(value_cid_reg);
+        if ((value_cid == kArrayCid) || (value_cid == kImmutableArrayCid)) {
+          __ cmpq(FieldAddress(value_reg, Array::length_offset()),
+                  Immediate(Smi::RawValue(field_length)));
+        } else if (RawObject::IsTypedDataClassId(value_cid)) {
+          __ cmpq(FieldAddress(value_reg, TypedData::length_offset()),
+                  Immediate(Smi::RawValue(field_length)));
+        } else if (field_cid != kIllegalCid) {
+          ASSERT(field_cid != value_cid);
+          ASSERT(field_length >= 0);
+          // Field has a known class id and length. At compile time it is
+          // known that the value's class id is not a fixed length list.
+          __ jmp(fail);
         } else {
           ASSERT(field_cid == kIllegalCid);
+          ASSERT(field_length == Field::kUnknownFixedLength);
           // Following jump cannot not occur, fall through.
         }
+        __ j(NOT_EQUAL, fail);
       }
       // Not identical, possibly null.
       __ Bind(&skip_length_check);
@@ -1613,61 +1646,61 @@ void GuardFieldInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
       __ movq(field_cid_operand, value_cid_reg);
       __ movq(field_nullability_operand, value_cid_reg);
       if (field_has_length) {
-        Label check_array, local_exit, local_fail;
+        Label check_array, length_set, no_fixed_length;
         __ cmpq(value_cid_reg, Immediate(kNullCid));
-        __ j(EQUAL, &local_fail);
+        __ j(EQUAL, &no_fixed_length, Assembler::kNearJump);
         // Check for typed data array.
         __ cmpq(value_cid_reg, Immediate(kTypedDataFloat32x4ArrayCid));
-        __ j(GREATER, &local_fail);  // Not a typed array or a regular array.
+        // Not a typed array or a regular array.
+        __ j(GREATER, &no_fixed_length);
         __ cmpq(value_cid_reg, Immediate(kTypedDataInt8ArrayCid));
-        __ j(LESS, &check_array);  // Could still be a regular array.
+        // Could still be a regular array.
+        __ j(LESS, &check_array, Assembler::kNearJump);
         // Destroy value_cid_reg (safe because we are finished with it).
         __ movq(value_cid_reg,
                 FieldAddress(value_reg, TypedData::length_offset()));
         __ movq(field_length_operand, value_cid_reg);
-        __ jmp(&local_exit);  // Updated field length typed data array.
+        // Updated field length typed data array.
+        __ jmp(&length_set);
         // Check for regular array.
         __ Bind(&check_array);
         __ cmpq(value_cid_reg, Immediate(kImmutableArrayCid));
-        __ j(GREATER, &local_fail);
+        __ j(GREATER, &no_fixed_length, Assembler::kNearJump);
         __ cmpq(value_cid_reg, Immediate(kArrayCid));
-        __ j(LESS, &local_fail);
+        __ j(LESS, &no_fixed_length, Assembler::kNearJump);
         // Destroy value_cid_reg (safe because we are finished with it).
         __ movq(value_cid_reg,
                 FieldAddress(value_reg, Array::length_offset()));
         __ movq(field_length_operand, value_cid_reg);
-        __ jmp(&local_exit);  // Updated field length from regular array.
-
-        __ Bind(&local_fail);
-        __ movq(field_length_operand, Immediate(Field::kNoFixedLength));
-
-        __ Bind(&local_exit);
+        // Updated field length from regular array.
+        __ jmp(&length_set, Assembler::kNearJump);
+        __ Bind(&no_fixed_length);
+        __ movq(field_length_operand,
+                Immediate(Smi::RawValue(Field::kNoFixedLength)));
+        __ Bind(&length_set);
       }
     } else {
-      if (value_cid_reg == kNoRegister) {
-          ASSERT(!compiler->is_optimizing());
-          value_cid_reg = RDX;
-          ASSERT((value_cid_reg != value_reg) && (field_reg != value_cid_reg));
-      }
-      ASSERT(value_cid_reg != kNoRegister);
       ASSERT(field_reg != kNoRegister);
       __ movq(field_cid_operand, Immediate(value_cid));
       __ movq(field_nullability_operand, Immediate(value_cid));
-      if ((value_cid == kArrayCid) || (value_cid == kImmutableArrayCid)) {
-        // Destroy value_cid_reg (safe because we are finished with it).
-        __ movq(value_cid_reg,
-                FieldAddress(value_reg, Array::length_offset()));
-        __ movq(field_length_operand, value_cid_reg);
-      } else if (RawObject::IsTypedDataClassId(value_cid)) {
-        // Destroy value_cid_reg (safe because we are finished with it).
-        __ movq(value_cid_reg,
-                FieldAddress(value_reg, TypedData::length_offset()));
-        __ movq(field_length_operand, value_cid_reg);
-      } else {
-        __ movq(field_length_operand, Immediate(Field::kNoFixedLength));
+      if (field_has_length) {
+        ASSERT(value_cid_reg != kNoRegister);
+        if ((value_cid == kArrayCid) || (value_cid == kImmutableArrayCid)) {
+          // Destroy value_cid_reg (safe because we are finished with it).
+          __ movq(value_cid_reg,
+                  FieldAddress(value_reg, Array::length_offset()));
+          __ movq(field_length_operand, value_cid_reg);
+        } else if (RawObject::IsTypedDataClassId(value_cid)) {
+          // Destroy value_cid_reg (safe because we are finished with it).
+          __ movq(value_cid_reg,
+                  FieldAddress(value_reg, TypedData::length_offset()));
+          __ movq(field_length_operand, value_cid_reg);
+        } else {
+          __ movq(field_length_operand,
+                  Immediate(Smi::RawValue(Field::kNoFixedLength)));
+        }
       }
     }
-
     if (!ok_is_fall_through) {
       __ jmp(&ok);
     }
@@ -1736,7 +1769,7 @@ void GuardFieldInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
           __ movq(value_cid_reg,
                   FieldAddress(value_reg, TypedData::length_offset()));
         }
-        __ cmpq(value_cid_reg, Immediate(field_length));
+        __ cmpq(value_cid_reg, Immediate(Smi::RawValue(field_length)));
         if (ok_is_fall_through) {
           __ j(NOT_EQUAL, fail);
         }