Fix more stack smashing bugs in test.

test/cctest/compiler/test-simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits>
 
 #include "src/compiler/control-builders.h"
 #include "src/compiler/generic-node-inl.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/pipeline.h"
@@ skipping 354 matching lines @@
     }
   }
 }
 
 
 TEST(RunLoadElementFromUntaggedBase) {
   Smi* smis[] = {Smi::FromInt(1), Smi::FromInt(2), Smi::FromInt(3),
                  Smi::FromInt(4), Smi::FromInt(5)};
 
   for (size_t i = 0; i < ARRAY_SIZE(smis); i++) {    // for header sizes
-    for (size_t j = i; j < ARRAY_SIZE(smis); j++) {  // for element index
+    for (size_t j = 0; (i + j) < ARRAY_SIZE(smis); j++) {  // for element index
       int offset = static_cast<int>(i * sizeof(Smi*));
       ElementAccess access = {kUntaggedBase, offset, Type::Integral32(),
                               kMachineTagged};
 
       SimplifiedGraphBuilderTester<Object*> t;
       Node* load = t.LoadElement(access, t.PointerConstant(smis),
                                  t.Int32Constant(static_cast<int>(j)));
       t.Return(load);
       t.LowerAllNodes();
 
       if (!Pipeline::SupportedTarget()) continue;
 
       for (int k = -5; k <= 5; k++) {
         Smi* expected = Smi::FromInt(k);
         smis[i + j] = expected;
         CHECK_EQ(expected, t.Call());
       }
     }
   }
 }
 
 
 TEST(RunStoreElementFromUntaggedBase) {
   Smi* smis[] = {Smi::FromInt(1), Smi::FromInt(2), Smi::FromInt(3),

[Michael Starzinger, 2014/08/04 14:09:58]

suggestion: We could memset the array to canary values on each iteration of the
i-j-loop and at the end (after the k-loop) memcmp that all element except the
one we tested against is untouched. Not sure whether it's worth it though.

                  Smi::FromInt(4), Smi::FromInt(5)};
 
   for (size_t i = 0; i < ARRAY_SIZE(smis); i++) {    // for header sizes
-    for (size_t j = i; j < ARRAY_SIZE(smis); j++) {  // for element index
+    for (size_t j = 0; (i + j) < ARRAY_SIZE(smis); j++) {  // for element index
       int offset = static_cast<int>(i * sizeof(Smi*));
       ElementAccess access = {kUntaggedBase, offset, Type::Integral32(),
                               kMachineTagged};
 
       SimplifiedGraphBuilderTester<Object*> t(kMachineTagged);
       Node* p0 = t.Parameter(0);
       t.StoreElement(access, t.PointerConstant(smis),
                      t.Int32Constant(static_cast<int>(j)), p0);
       t.Return(p0);
       t.LowerAllNodes();
 
       if (!Pipeline::SupportedTarget()) continue;
 
+      printf("i = %ld, j = %ld\n", i, j);

[Michael Starzinger, 2014/08/04 14:09:58]

nit: Looks like a leftover.

       for (int k = -5; k <= 5; k++) {
         Smi* expected = Smi::FromInt(k);
         smis[i + j] = Smi::FromInt(-100);
         CHECK_EQ(expected, t.Call(expected));
         CHECK_EQ(expected, smis[i + j]);
       }
     }
   }
 }