Add some testcases for bug #2470.

src/test/run-fail/bug-2470-bounds-check-overflow-2.rs

@@ -0,0 +1,17 @@
+// xfail-test
+// error-pattern:bounds check
+
+fn main() {
+    let x = [1u,2u,3u];
+
+    // This should cause a bounds-check failure, but may not if we do our
+    // bounds checking by comparing a scaled index value to the vector's
+    // length (in bytes), because the scaling of the index will cause it to
+    // wrap around to a small number.
+
+    let idx = uint::max_value & !(uint::max_value >> 1u);
+    #error("ov2 idx = 0x%x", idx);
+
+    // This should fail.
+    #error("ov2 0x%x",  x[idx]);
+}

src/test/run-fail/bug-2470-bounds-check-overflow-3.rs

@@ -0,0 +1,28 @@
+// xfail-test
+// error-pattern:bounds check
+
+#[cfg(target_arch="x86")]
+fn main() {
+    let x = [1u,2u,3u];
+
+    // This should cause a bounds-check failure, but may not if we do our
+    // bounds checking by truncating the index value to the size of the
+    // machine word, losing relevant bits of the index value.
+
+    // This test is only meaningful on 32-bit hosts.
+
+    let idx = u64::max_value & !(u64::max_value >> 1u);
+    #error("ov3 idx = 0x%8.8x%8.8x",
+           (idx >> 32) as uint,
+           idx as uint);
+
+    // This should fail.
+    #error("ov3 0x%x",  x[idx]);
+}
+
+#[cfg(target_arch="x86_64")]
+fn main() {
+    // This version just fails anyways, for symmetry on 64-bit hosts.
+    let x = [1u,2u,3u];
+    #error("ov3 0x%x",  x[200]);
+}

src/test/run-fail/bug-2470-bounds-check-overflow.rs

@@ -0,0 +1,24 @@
+// error-pattern:bounds check
+
+fn main() {
+
+    // This should cause a bounds-check failure, but may not if we do our
+    // bounds checking by comparing the scaled index to the vector's
+    // address-bounds, since we've scaled the index to wrap around to the
+    // address of the 0th cell in the array (even though the index is
+    // huge).
+
+    let x = [1u,2u,3u];
+    vec::unpack_slice(x) {|p, _len|
+        let base = p as uint;                     // base = 0x1230 say
+        let idx = base / sys::size_of::<uint>();  // idx  = 0x0246 say
+        #error("ov1 base = 0x%x", base);
+        #error("ov1 idx = 0x%x", idx);
+        #error("ov1 sizeof::<uint>() = 0x%x", sys::size_of::<uint>());
+        #error("ov1 idx * sizeof::<uint>() = 0x%x",
+               idx * sys::size_of::<uint>());
+
+        // This should fail.
+        #error("ov1 0x%x",  x[idx]);
+    }
+}