Do not directly load smi constants larger than a 16 bit payload on ia32.

runtime/vm/assembler_ia32.h

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_ASSEMBLER_IA32_H_
 #define VM_ASSEMBLER_IA32_H_
 
 #ifndef VM_ASSEMBLER_H_
 #error Do not include assembler_ia32.h directly; use assembler.h instead.
 #endif
@@ skipping 293 matching lines @@
 #endif
 };
 
 
 class Assembler : public ValueObject {
  public:
   explicit Assembler(bool use_far_branches = false)
       : buffer_(),
         object_pool_(GrowableObjectArray::Handle()),
         prologue_offset_(-1),
-        comments_() {
+        comments_(),
+        jit_cookie_(1017109444) {
     // This mode is only needed and implemented for MIPS and ARM.
     ASSERT(!use_far_branches);
   }
   ~Assembler() { }
 
   static const bool kNearJump = true;
   static const bool kFarJump = false;
 
   /*
    * Emit Machine Instructions.
@@ skipping 304 matching lines @@
   // Issues a move instruction if 'to' is not the same as 'from'.
   void MoveRegister(Register to, Register from);
   void PopRegister(Register r);
 
   void AddImmediate(Register reg, const Immediate& imm);
 
   void Drop(intptr_t stack_elements);
 
   void LoadObject(Register dst, const Object& object);
 
+  // If 'object' is a Smi, xor it with a per-assembler cookie value to

[srdjan, 2013/10/28 23:06:49]

If 'object' is unsafe Smi.

+  // prevent user-controlled immediates from appearing in the code stream.
+  void LoadObjectSafely(Register dst, const Object& object);
+
   void PushObject(const Object& object);
   void CompareObject(Register reg, const Object& object);
   void LoadDoubleConstant(XmmRegister dst, double value);
 
   void StoreIntoObject(Register object,  // Object we are storing into.
                        const Address& dest,  // Where we are storing into.
                        Register value,  // Value we are storing.
                        bool can_value_be_smi = true);
 
   void StoreIntoObjectNoBarrier(Register object,
@@ skipping 126 matching lines @@
   void Unreachable(const char* message);
 
   static void InitializeMemoryWithBreakpoints(uword data, intptr_t length);
 
   void Comment(const char* format, ...) PRINTF_ATTRIBUTE(2, 3);
   const Code::Comments& GetCodeComments() const;
 
   static const char* RegisterName(Register reg);
   static const char* FpuRegisterName(FpuRegister reg);
 
+  // Smis that do not fit into 17 bits (16 bits of payload) are unsafe.
+  static bool IsSafe(const Object& object) {
+    return !object.IsSmi() ||
+        Utils::IsInt(17, reinterpret_cast<intptr_t>(object.raw()));
+  }
+  static bool IsSafeSmi(const Object& object) {
+    return object.IsSmi() &&
+        Utils::IsInt(17, reinterpret_cast<intptr_t>(object.raw()));
+  }
+
  private:
   AssemblerBuffer buffer_;
   GrowableObjectArray& object_pool_;  // Object pool is not used on ia32.
   intptr_t prologue_offset_;
 
   class CodeComment : public ZoneAllocated {
    public:
     CodeComment(intptr_t pc_offset, const String& comment)
         : pc_offset_(pc_offset), comment_(comment) { }
 
     intptr_t pc_offset() const { return pc_offset_; }
     const String& comment() const { return comment_; }
 
    private:
     intptr_t pc_offset_;
     const String& comment_;
 
     DISALLOW_COPY_AND_ASSIGN(CodeComment);
   };
 
   GrowableArray<CodeComment*> comments_;
 
+  int32_t jit_cookie_;
+
   inline void EmitUint8(uint8_t value);
   inline void EmitInt32(int32_t value);
   inline void EmitRegisterOperand(int rm, int reg);
   inline void EmitXmmRegisterOperand(int rm, XmmRegister reg);
   inline void EmitFixup(AssemblerFixup* fixup);
   inline void EmitOperandSizeOverride();
 
   void EmitOperand(int rm, const Operand& operand);
   void EmitImmediate(const Immediate& imm);
   void EmitComplex(int rm, const Operand& operand, const Immediate& immediate);
@@ skipping 42 matching lines @@
 }
 
 
 inline void Assembler::EmitOperandSizeOverride() {
   EmitUint8(0x66);
 }
 
 }  // namespace dart
 
 #endif  // VM_ASSEMBLER_IA32_H_