diff --git a/runtime/vm/compiler/graph_intrinsifier.cc b/runtime/vm/compiler/graph_intrinsifier.cc index db4e7dc7278..d251b3ed90a 100644 --- a/runtime/vm/compiler/graph_intrinsifier.cc +++ b/runtime/vm/compiler/graph_intrinsifier.cc @@ -285,6 +285,8 @@ static bool IntrinsifyArraySetIndexed(FlowGraph* flow_graph, case kTypedDataUint16ArrayCid: case kExternalTypedDataUint8ArrayCid: case kExternalTypedDataUint8ClampedArrayCid: + builder.AddInstruction(new CheckSmiInstr(new Value(value), DeoptId::kNone, + builder.TokenPos())); value = builder.AddUnboxInstr(kUnboxedIntPtr, new Value(value), /* is_checked = */ false); value->AsUnboxInteger()->mark_truncating(); diff --git a/tests/language_2/vm/clamp_37868_test.dart b/tests/language_2/vm/clamp_37868_test.dart new file mode 100755 index 00000000000..181f895fee8 --- /dev/null +++ b/tests/language_2/vm/clamp_37868_test.dart @@ -0,0 +1,34 @@ +// Copyright (c) 2019, the Dart project authors. Please see the AUTHORS file +// for details. All rights reserved. Use of this source code is governed by a +// BSD-style license that can be found in the LICENSE file. + +// VMOptions=--deterministic + +import "package:expect/expect.dart"; + +import 'dart:typed_data'; + +// Found by "value-guided" DartFuzzing: incorrect clamping. +// https://github.com/dart-lang/sdk/issues/37868 +@pragma("vm:never-inline") +foo(List x) => Uint8ClampedList.fromList(x); + +main() { + var x = [ + 9223372036854775807, + -9223372036854775808, + 9223372032559808513, + -9223372032559808513, + 5000000000, + -5000000000, + 2147483647, + -2147483648, + 255, + -255, + ]; + var y = foo(x); + for (int i = 0; i < y.length; i += 2) { + Expect.equals(255, y[i]); + Expect.equals(0, y[i + 1]); + } +}