Fixed crashes exposed though fuzzing.

src/x64/macro-assembler-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3188 matching lines @@
     testl(result_reg, result_reg);
     j(not_zero, &done, Label::kNear);
     movmskpd(result_reg, xmm0);
     andl(result_reg, Immediate(1));
     j(not_zero, lost_precision, dst);
   }
   bind(&done);
 }
 
 
+void MacroAssembler::Throw(BailoutReason reason) {
+  // We want to pass the msg string like a smi to avoid GC
+  // problems, however msg is not guaranteed to be aligned
+  // properly. Instead, we pass an aligned pointer that is
+  // a proper v8 smi, but also pass the alignment difference
+  // from the real pointer as a smi.
+  const char* msg = GetBailoutReason(reason);
+  intptr_t p1 = reinterpret_cast<intptr_t>(msg);
+  intptr_t p0 = (p1 & ~kSmiTagMask) + kSmiTag;
+  // Note: p0 might not be a valid Smi _value_, but it has a valid Smi tag.
+  ASSERT(reinterpret_cast<Object*>(p0)->IsSmi());
+#ifdef DEBUG
+  if (msg != NULL) {
+    RecordComment("Throw message: ");
+    RecordComment(msg);
+  }
+#endif
+
+  push(rax);
+  movq(kScratchRegister, reinterpret_cast<Smi*>(p0), RelocInfo::NONE64);
+  push(kScratchRegister);
+  movq(kScratchRegister, Smi::FromInt(static_cast<int>(p1 - p0)),
+       RelocInfo::NONE64);
+  push(kScratchRegister);
+
+  if (!has_frame_) {
+    // We don't actually want to generate a pile of code for this, so just
+    // claim there is a stack frame, without generating one.
+    FrameScope scope(this, StackFrame::NONE);
+    CallRuntime(Runtime::kThrowMessage, 2);
+  } else {
+    CallRuntime(Runtime::kThrowMessage, 2);
+  }
+  // Control will not return here.
+  int3();
+}
+
+
+void MacroAssembler::ThrowIfNot(Condition cc, BailoutReason reason) {
+  Label L;
+  j(cc, &L);
+  Throw(reason);
+  // will not return here
+  bind(&L);
+}
+
+
 void MacroAssembler::LoadInstanceDescriptors(Register map,
                                              Register descriptors) {
   movq(descriptors, FieldOperand(map, Map::kDescriptorsOffset));
 }
 
 
 void MacroAssembler::NumberOfOwnDescriptors(Register dst, Register map) {
   movq(dst, FieldOperand(map, Map::kBitField3Offset));
   DecodeField<Map::NumberOfOwnDescriptorsBits>(dst);
 }
@@ skipping 1405 matching lines @@
   const int kMinimumStackSlots = kRegisterPassedArguments;
   if (num_arguments < kMinimumStackSlots) return kMinimumStackSlots;
   return num_arguments;
 #else
   if (num_arguments < kRegisterPassedArguments) return 0;
   return num_arguments - kRegisterPassedArguments;
 #endif
 }
 
 
+void MacroAssembler::EmitSeqStringSetCharCheck(Register string,
+                                               Register index,
+                                               Register value,
+                                               uint32_t encoding_mask) {
+  ThrowIfNot(CheckSmi(index), kNonSmiIndex);
+  ThrowIfNot(CheckSmi(value), kNonSmiValue);
+
+  Label is_object;
+  JumpIfNotSmi(string, &is_object);
+  Throw(kNonObject);
+  bind(&is_object);
+
+  SmiCompare(index, FieldOperand(string, String::kLengthOffset));
+  ThrowIfNot(less, kIndexIsTooLarge);
+
+  SmiCompare(index, Smi::FromInt(0));
+  ThrowIfNot(greater_equal, kIndexIsNegative);
+
+  push(value);
+  movq(value, FieldOperand(string, HeapObject::kMapOffset));
+  movzxbq(value, FieldOperand(value, Map::kInstanceTypeOffset));
+
+  andb(value, Immediate(kStringRepresentationMask | kStringEncodingMask));
+  cmpq(value, Immediate(encoding_mask));
+  pop(value);
+  ThrowIfNot(equal, kUnexpectedStringType);
+}
+
+
 void MacroAssembler::PrepareCallCFunction(int num_arguments) {
   int frame_alignment = OS::ActivationFrameAlignment();
   ASSERT(frame_alignment != 0);
   ASSERT(num_arguments >= 0);
 
   // Make stack end at alignment and allocate space for arguments and old rsp.
   movq(kScratchRegister, rsp);
   ASSERT(IsPowerOf2(frame_alignment));
   int argument_slots_on_stack =
       ArgumentStackSlotsForCFunctionCall(num_arguments);
@@ skipping 341 matching lines @@
   j(equal, found);
   movq(current, FieldOperand(current, Map::kPrototypeOffset));
   CompareRoot(current, Heap::kNullValueRootIndex);
   j(not_equal, &loop_again);
 }
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64