Do not directly load smi constants larger than a 16 bit payload on ia32.

runtime/vm/assembler_ia32.h

Index: runtime/vm/assembler_ia32.h
diff --git a/runtime/vm/assembler_ia32.h b/runtime/vm/assembler_ia32.h
index f53bf3777dd00b03f6e10e8812b33aee7566c053..c743ae9cb74db84d8cd60007718375eb38c99392 100644
--- a/runtime/vm/assembler_ia32.h
+++ b/runtime/vm/assembler_ia32.h
@@ -311,7 +311,8 @@ class Assembler : public ValueObject {
       : buffer_(),
         object_pool_(GrowableObjectArray::Handle()),
         prologue_offset_(-1),
-        comments_() {
+        comments_(),
+        jit_cookie_(1017109444) {
     // This mode is only needed and implemented for MIPS and ARM.
     ASSERT(!use_far_branches);
   }
@@ -636,6 +637,10 @@ class Assembler : public ValueObject {
 
   void LoadObject(Register dst, const Object& object);
 
+  // If 'object' is a Smi, xor it with a per-assembler cookie value to

[srdjan, 2013/10/28 23:06:49]

If 'object' is unsafe Smi.

+  // prevent user-controlled immediates from appearing in the code stream.
+  void LoadObjectSafely(Register dst, const Object& object);
+
   void PushObject(const Object& object);
   void CompareObject(Register reg, const Object& object);
   void LoadDoubleConstant(XmmRegister dst, double value);
@@ -782,6 +787,16 @@ class Assembler : public ValueObject {
   static const char* RegisterName(Register reg);
   static const char* FpuRegisterName(FpuRegister reg);
 
+  // Smis that do not fit into 17 bits (16 bits of payload) are unsafe.
+  static bool IsSafe(const Object& object) {
+    return !object.IsSmi() ||
+        Utils::IsInt(17, reinterpret_cast<intptr_t>(object.raw()));
+  }
+  static bool IsSafeSmi(const Object& object) {
+    return object.IsSmi() &&
+        Utils::IsInt(17, reinterpret_cast<intptr_t>(object.raw()));
+  }
+
  private:
   AssemblerBuffer buffer_;
   GrowableObjectArray& object_pool_;  // Object pool is not used on ia32.
@@ -804,6 +819,8 @@ class Assembler : public ValueObject {
 
   GrowableArray<CodeComment*> comments_;
 
+  int32_t jit_cookie_;
+
   inline void EmitUint8(uint8_t value);
   inline void EmitInt32(int32_t value);
   inline void EmitRegisterOperand(int rm, int reg);