Fix issue 14659: intrinsic method must check if the start, end arguments are Smi.

runtime/vm/intrinsifier_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 1561 matching lines @@
   // Clear hash.
   __ movq(FieldAddress(RAX, String::hash_offset()), Immediate(0));
   __ jmp(ok, Assembler::kNearJump);
 
   __ Bind(&pop_and_fail);
   __ popq(RDI);
   __ jmp(failure);
 }
 
 
-// Arg0: Onebyte String
+// Arg0: OneByteString (receiver).
 // Arg1: Start index as Smi.
 // Arg2: End index as Smi.
 // The indexes must be valid.
 void Intrinsifier::OneByteString_substringUnchecked(Assembler* assembler) {
   const intptr_t kStringOffset = 3 * kWordSize;
   const intptr_t kStartIndexOffset = 2 * kWordSize;
   const intptr_t kEndIndexOffset = 1 * kWordSize;
   Label fall_through, ok;
+  __ movq(RSI, Address(RSP, + kEndIndexOffset));
   __ movq(RDI, Address(RSP, + kEndIndexOffset));
+  __ orq(RSI, RDI);
+  __ testq(RSI, Immediate(kSmiTagMask));
+  __ j(NOT_ZERO, &fall_through);  // 'start', 'end' not Smi.
+
   __ subq(RDI, Address(RSP, + kStartIndexOffset));
   TryAllocateOnebyteString(assembler, &ok, &fall_through, RDI);
   __ Bind(&ok);
   // RAX: new string as tagged pointer.
   // Copy string.
   __ movq(RSI, Address(RSP, + kStringOffset));
   __ movq(RBX, Address(RSP, + kStartIndexOffset));
   __ SmiUntag(RBX);
   __ leaq(RSI, FieldAddress(RSI, RBX, TIMES_1, OneByteString::data_offset()));
   // RSI: Start address to copy from (untagged).
@@ skipping 109 matching lines @@
 
 void Intrinsifier::TwoByteString_equality(Assembler* assembler) {
   StringEquality(assembler, kTwoByteStringCid);
 }
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64