Fixed crashes exposed though fuzzing.

Fixed crashes exposed though fuzzing.

The %_OneByteSeqStringSetChar intrinsic expects its arguments to be checked before being called for efficiency reasons, but the fuzzer provided no such checks. Now the intrinsic is robust to bad input if FLAG_debug_code is set.

R=yangguo@chromium.org
TEST=test/mjsunit/regress/regress-320948.js
BUG=chromium:320948
LOG=Y

Committed: http://code.google.com/p/v8/source/detail?r=17886

[danno, 2013-11-19 14:11:50]

PTAL

[danno, 2013-11-19 14:19:44]

PTAL

[Yang, 2013-11-19 14:35:29]

LGTM once comments are addressed.

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
File src/arm/macro-assembler-arm.cc (right):

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
src/arm/macro-assembler-arm.cc:3405: b(ne, &is_object);
Use ThrowIfNot(ne, kNonObject) instead?

Personally I would like ThrowIf better, for better readability (no double
negation). We do have a NegateCondition function for this purpose.

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
src/arm/macro-assembler-arm.cc:3819: intptr_t p0 = (p1 & ~kSmiTagMask) +
kSmiTag;
How about just encoding the reason enum as smi and pass that to the runtime?

https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
File test/mjsunit/fuzz-natives-part3.js (right):

https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
test/mjsunit/fuzz-natives-part3.js:119: "ThrowMessage": true,
Please sync that to the other files named fuzz-natives-part{1,2,4}.js as well.

[Yang, 2013-11-19 14:38:28]

On 2013/11/19 14:35:29, Yang wrote:
> LGTM once comments are addressed.
> 
>
https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
> File src/arm/macro-assembler-arm.cc (right):
> 
>
https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
> src/arm/macro-assembler-arm.cc:3405: b(ne, &is_object);
> Use ThrowIfNot(ne, kNonObject) instead?
> 
> Personally I would like ThrowIf better, for better readability (no double
> negation). We do have a NegateCondition function for this purpose.
> 
>
https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
> src/arm/macro-assembler-arm.cc:3819: intptr_t p0 = (p1 & ~kSmiTagMask) +
> kSmiTag;
> How about just encoding the reason enum as smi and pass that to the runtime?
> 
>
https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
> File test/mjsunit/fuzz-natives-part3.js (right):
> 
>
https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
> test/mjsunit/fuzz-natives-part3.js:119: "ThrowMessage": true,
> Please sync that to the other files named fuzz-natives-part{1,2,4}.js as well.

btw those comments apply to all platforms.

[danno, 2013-11-19 16:19:13]

Feedback addressed, landing

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
File src/arm/macro-assembler-arm.cc (right):

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
src/arm/macro-assembler-arm.cc:3405: b(ne, &is_object);
On 2013/11/19 14:35:29, Yang wrote:
> Use ThrowIfNot(ne, kNonObject) instead?
> 
> Personally I would like ThrowIf better, for better readability (no double
> negation). We do have a NegateCondition function for this purpose.

Done.

https://codereview.chromium.org/72813004/diff/30001/src/arm/macro-assembler-a...
src/arm/macro-assembler-arm.cc:3819: intptr_t p0 = (p1 & ~kSmiTagMask) +
kSmiTag;
On 2013/11/19 14:35:29, Yang wrote:
> How about just encoding the reason enum as smi and pass that to the runtime?

Done.

https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
File test/mjsunit/fuzz-natives-part3.js (right):

https://codereview.chromium.org/72813004/diff/30001/test/mjsunit/fuzz-natives...
test/mjsunit/fuzz-natives-part3.js:119: "ThrowMessage": true,
On 2013/11/19 14:35:29, Yang wrote:
> Please sync that to the other files named fuzz-natives-part{1,2,4}.js as well.

Done.

[danno, 2013-11-19 16:41:29]

Committed patchset #5 manually as r17886.