Fix issue 14659: intrinsic method must check if the start, end arguments are Smi.

runtime/vm/intrinsifier_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_MIPS.
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 1641 matching lines @@
   // Set the length field using the saved length (T6).
   __ StoreIntoObjectNoBarrier(V0,
                               FieldAddress(V0, String::length_offset()),
                               T6);
   // Clear hash.
   __ b(ok);
   __ delay_slot()->sw(ZR, FieldAddress(V0, String::hash_offset()));
 }
 
 
-// Arg0: Onebyte String
+// Arg0: OneByteString (receiver).
 // Arg1: Start index as Smi.
 // Arg2: End index as Smi.
 // The indexes must be valid.
 void Intrinsifier::OneByteString_substringUnchecked(Assembler* assembler) {
   const intptr_t kStringOffset = 2 * kWordSize;
   const intptr_t kStartIndexOffset = 1 * kWordSize;
   const intptr_t kEndIndexOffset = 0 * kWordSize;
   Label fall_through, ok;
 
   __ lw(T2, Address(SP, kEndIndexOffset));
   __ lw(TMP, Address(SP, kStartIndexOffset));
+  __ or_(CMPRES, T2, TMP);
+  __ andi(CMPRES, CMPRES, Immediate(kSmiTagMask));
+  __ bne(CMPRES, ZR, &fall_through);  // 'start', 'end' not Smi.
+
   __ subu(T2, T2, TMP);
   TryAllocateOnebyteString(assembler, &ok, &fall_through);
   __ Bind(&ok);
   // V0: new string as tagged pointer.
   // Copy string.
   __ lw(T3, Address(SP, kStringOffset));
   __ lw(T1, Address(SP, kStartIndexOffset));
   __ SmiUntag(T1);
   __ addu(T3, T3, T1);
   __ AddImmediate(T3, OneByteString::data_offset() - 1);
@@ skipping 113 matching lines @@
 }
 
 
 void Intrinsifier::TwoByteString_equality(Assembler* assembler) {
   StringEquality(assembler, kTwoByteStringCid);
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS