Fix issue 14659: intrinsic method must check if the start, end arguments are Smi.

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 1650 matching lines @@
   // Clear hash.
   __ movl(FieldAddress(EAX, String::hash_offset()), Immediate(0));
   __ jmp(ok, Assembler::kNearJump);
 
   __ Bind(&pop_and_fail);
   __ popl(EDI);
   __ jmp(failure);
 }
 
 
-// Arg0: Onebyte String
+// Arg0: OneByteString (receiver)
 // Arg1: Start index as Smi.
 // Arg2: End index as Smi.
 // The indexes must be valid.
 void Intrinsifier::OneByteString_substringUnchecked(Assembler* assembler) {
   const intptr_t kStringOffset = 3 * kWordSize;
   const intptr_t kStartIndexOffset = 2 * kWordSize;
   const intptr_t kEndIndexOffset = 1 * kWordSize;
   Label fall_through, ok;
+  __ movl(EAX, Address(ESP, + kStartIndexOffset));
   __ movl(EDI, Address(ESP, + kEndIndexOffset));
+  __ orl(EAX, EDI);
+  __ testl(EAX, Immediate(kSmiTagMask));
+  __ j(NOT_ZERO, &fall_through);  // 'start', 'end' not Smi.
+
   __ subl(EDI, Address(ESP, + kStartIndexOffset));
   TryAllocateOnebyteString(assembler, &ok, &fall_through, EDI);
   __ Bind(&ok);
   // EAX: new string as tagged pointer.
   // Copy string.
   __ movl(EDI, Address(ESP, + kStringOffset));
   __ movl(EBX, Address(ESP, + kStartIndexOffset));
   __ SmiUntag(EBX);
   __ leal(EDI, FieldAddress(EDI, EBX, TIMES_1, OneByteString::data_offset()));
   // EDI: Start address to copy from (untagged).
@@ skipping 108 matching lines @@
 
 
 void Intrinsifier::TwoByteString_equality(Assembler* assembler) {
   StringEquality(assembler, kTwoByteStringCid);
 }
 
 #undef __
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32