Enforce length/size limits for variable size heap object in order to

vm/object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_OBJECT_H_
 #define VM_OBJECT_H_
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "platform/utils.h"
 #include "vm/bitmap.h"
 #include "vm/dart.h"
 #include "vm/globals.h"
 #include "vm/handles.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/os.h"
 #include "vm/raw_object.h"
 #include "vm/scanner.h"
 
 namespace dart {
 
+#define MAX_ELEMENTS(type)                                                     \
+  ((kIntptrMax - sizeof(Raw##type) - sizeof(RawObject)) /                      \

[cshapiro, 2012/07/17 22:54:30]

Give consideration to the maximum value of a Smi.

[turnidge, 2012/07/18 18:17:04]

This is awkward to do, since the Smi::MaxValue isn't defined yet at this point.

...

Are you sure we need to check this here?  My goal is to prevent overflow of the
intptr_t type used to compute instance sizes.  Is there any reason why I should
need to enforce the Smi max here?

[cshapiro, 2012/07/19 05:49:01]

I lost an earlier comment.  It may appear after I publish, sorry if there is any
confusion.

Maybe I am totally wrong about this but as I see it MAX_ELEMENTS will over
estimate the maximum number of elements in a collection of a given element
width.  As such, I am not entirely enthusiastic about it in its current form,
its name, or the kMaxElements name.

For example, the maximum number of elements of an Int8Array or Uint8Array is the
maximum Smi value as we do not permit a Bigint valued index.  The Smi range is
always half the intptr_t range and, as such, MAX_ELEMENTS will always
over-estimate its value to be outside the Smi range, ((0x7FFFFFFF - 8 - 4) / 1)
> 0x3fffffff  

I think it would be a little bit simpler to have max value be computed as
follows

  (Smi::kMaxValue >> 0) for  8-bit elements
  (Smi::kMaxValue >> 1) for 16-bit elements
  (Smi::kMaxValue >> 2) for 32-bit elements 
  (Smi::kMaxValue >> 3) for 64-bit elements  

The halving of the range of a Smi versus inptr_t provides enough slop to
discount header sizes entirely.  Furthemore, kMaxElements can be encoded as a
Smi without overflowing to a Bigint.

[turnidge, 2012/07/31 23:21:45]

Done.

+  type::kBytesPerElement)
+
 // Forward declarations.
 #define DEFINE_FORWARD_DECLARATION(clazz)                                      \
   class clazz;
 CLASS_LIST(DEFINE_FORWARD_DECLARATION)
 #undef DEFINE_FORWARD_DECLARATION
 class Api;
 class Assembler;
 class Code;
 class LocalScope;
 
@@ skipping 1160 matching lines @@
   virtual void SetTypeAt(intptr_t index, const AbstractType& value) const;
   virtual bool IsResolved() const;
   virtual bool IsInstantiated() const;
   virtual bool IsUninstantiatedIdentity() const;
   // Canonicalize only if instantiated, otherwise returns 'this'.
   virtual RawAbstractTypeArguments* Canonicalize() const;
 
   virtual RawAbstractTypeArguments* InstantiateFrom(
       const AbstractTypeArguments& instantiator_type_arguments) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TypeArguments);
+
   static intptr_t length_offset() {
     return OFFSET_OF(RawTypeArguments, length_);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTypeArguments) == OFFSET_OF(RawTypeArguments, types_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that the types_ is not adding to the object length.
     ASSERT(sizeof(RawTypeArguments) == (sizeof(RawObject) + (1 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawTypeArguments) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTypeArguments) + (len * kBytesPerElement));
   }
 
   static RawTypeArguments* New(intptr_t len, Heap::Space space = Heap::kOld);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxTypes = 512 * 1024 * 1024;
   RawAbstractType** TypeAddr(intptr_t index) const;
   void SetLength(intptr_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(TypeArguments, AbstractTypeArguments);
   friend class Class;
 };
 
 
 // An instance of InstantiatedTypeArguments is never encountered at compile
 // time, but only at run time, when type parameters can be matched to actual
@@ skipping 467 matching lines @@
  public:
   inline intptr_t Length() const;
 
   RawArray* TokenObjects() const;
   void SetTokenObjects(const Array& value) const;
 
   RawString* GenerateSource() const;
   intptr_t ComputeSourcePosition(intptr_t tok_pos) const;
   intptr_t ComputeTokenPosition(intptr_t src_pos) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TokenStream);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTokenStream) == OFFSET_OF(RawTokenStream, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTokenStream) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTokenStream) + (len * kBytesPerElement));
   }
 
   static RawTokenStream* New(intptr_t length);
   static RawTokenStream* New(const Scanner::GrowableTokenStream& tokens);
 
   // The class Iterator encapsulates iteration over the tokens
   // in a TokenStream object.
   class Iterator : ValueObject {
    public:
     Iterator(const TokenStream& tokens, intptr_t token_pos);
@@ skipping 314 matching lines @@
 
 class Instructions : public Object {
  public:
   intptr_t size() const { return raw_ptr()->size_; }
   RawCode* code() const { return raw_ptr()->code_; }
 
   uword EntryPoint() const {
     return reinterpret_cast<uword>(raw_ptr()) + HeaderSize();
   }
 
+  static const intptr_t kMaxElements = (kIntptrMax -
+                                        (sizeof(RawInstructions) +
+                                         sizeof(RawObject) +
+                                         (2 * OS::kMaxPreferredCodeAlignment)));
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInstructions) == OFFSET_OF(RawInstructions, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t size) {
     intptr_t instructions_size = Utils::RoundUp(size,
                                                 OS::PreferredCodeAlignment());
     intptr_t result = instructions_size + HeaderSize();
     ASSERT(result % OS::PreferredCodeAlignment() == 0);
@@ skipping 35 matching lines @@
   intptr_t Length() const;
 
   RawString* GetName(intptr_t var_index) const;
 
   void SetVar(intptr_t var_index,
               const String& name,
               RawLocalVarDescriptors::VarInfo* info) const;
 
   void GetInfo(intptr_t var_index, RawLocalVarDescriptors::VarInfo* info) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawLocalVarDescriptors::VarInfo);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(LocalVarDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawLocalVarDescriptors) ==
         OFFSET_OF(RawLocalVarDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawLocalVarDescriptors) +
-        (len * sizeof(RawLocalVarDescriptors::VarInfo)));
+        sizeof(RawLocalVarDescriptors) + (len * kBytesPerElement));
   }
 
   static RawLocalVarDescriptors* New(intptr_t num_variables);
 
  private:
   HEAP_OBJECT_IMPLEMENTATION(LocalVarDescriptors, Object);
   friend class Class;
 };
 
 
 class PcDescriptors : public Object {
+ private:
+  // Describes the layout of PC descriptor data.
+  enum {
+    kPcEntry = 0,      // PC value of the descriptor, unique.
+    kKindEntry,
+    kNodeIdEntry,      // AST node id.
+    kTokenIndexEntry,  // Token position in source of PC.
+    kTryIndexEntry,    // Try block index of PC.
+    // We would potentially be adding other objects here like
+    // pointer maps for optimized functions, local variables information  etc.
+    kNumberOfEntries
+  };
+
  public:
   enum Kind {
     kDeopt = 0,  // Deoptimization cotinuation point.
     kPatchCode,  // Buffer for patching code entry.
     kIcCall,     // IC call.
     kFuncCall,   // Call to known target, e.g. static call, closure call.
     kReturn,     // Return from function.
     kOther
   };
 
@@ skipping 12 matching lines @@
                      intptr_t node_id,
                      intptr_t token_pos,
                      intptr_t try_index) const {
     SetPC(index, pc);
     SetKind(index, kind);
     SetNodeId(index, node_id);
     SetTokenIndex(index, token_pos);
     SetTryIndex(index, try_index);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(PcDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawPcDescriptors) == OFFSET_OF(RawPcDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawPcDescriptors) + (len * kNumberOfEntries * kWordSize));
+        sizeof(RawPcDescriptors) + (len * kBytesPerElement));
   }
 
   static RawPcDescriptors* New(intptr_t num_descriptors);
 
   // Verify (assert) assumptions about pc descriptors in debug mode.
   void Verify(bool check_ids) const;
 
   // We would have a VisitPointers function here to traverse the
   // pc descriptors table to visit objects if any in the table.
 
  private:
-  // Describes the layout of PC descriptor data.
-  enum {
-    kPcEntry = 0,      // PC value of the descriptor, unique.
-    kKindEntry,
-    kNodeIdEntry,      // AST node id.
-    kTokenIndexEntry,  // Token position in source of PC.
-    kTryIndexEntry,    // Try block index of PC.
-    // We would potentially be adding other objects here like
-    // pointer maps for optimized functions, local variables information  etc.
-    kNumberOfEntries
-  };
-
   void SetPC(intptr_t index, uword value) const;
   void SetKind(intptr_t index, PcDescriptors::Kind kind) const;
   void SetNodeId(intptr_t index, intptr_t value) const;
   void SetTokenIndex(intptr_t index, intptr_t value) const;
   void SetTryIndex(intptr_t index, intptr_t value) const;
 
   void SetLength(intptr_t value) const;
 
   intptr_t* EntryAddr(intptr_t index, intptr_t entry_offset) const {
     ASSERT((index >=0) && (index < Length()));
@@ skipping 22 matching lines @@
 
   RawCode* GetCode() const { return raw_ptr()->code_; }
   void SetCode(const Code& code) const;
 
   // Return the offset of the highest stack slot that has an object.
   intptr_t MaximumBitOffset() const { return raw_ptr()->max_set_bit_offset_; }
 
   // Return the offset of the lowest stack slot that has an object.
   intptr_t MinimumBitOffset() const { return raw_ptr()->min_set_bit_offset_; }
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Stackmap);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawStackmap) == OFFSET_OF(RawStackmap, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t size) {
-    return RoundedAllocationSize(sizeof(RawStackmap) + (size * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawStackmap) + (len * kBytesPerElement));
   }
   static RawStackmap* New(uword pc, BitmapBuilder* bmap);
 
  private:
   inline intptr_t SizeInBits() const;
 
   void SetMinBitOffset(intptr_t value) const {
     raw_ptr()->min_set_bit_offset_ = value;
   }
   void SetMaxBitOffset(intptr_t value) const {
     raw_ptr()->max_set_bit_offset_ = value;
   }
 
   bool InRange(intptr_t offset) const { return offset < SizeInBits(); }
 
   bool GetBit(intptr_t bit_offset) const;
   void SetBit(intptr_t bit_offset, bool value) const;
 
   void set_bitmap_size_in_bytes(intptr_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(Stackmap, Object);
   friend class Class;
   friend class BitmapBuilder;
 };
 
 
 class ExceptionHandlers : public Object {
+ private:
+  // Describes the layout of exception handler data.
+  enum {
+    kTryIndexEntry = 0,  // Try block index associated with handler.
+    kHandlerPcEntry,  // PC value of handler.
+    kNumberOfEntries
+  };
+
  public:
   intptr_t Length() const;
 
   intptr_t TryIndex(intptr_t index) const;
   intptr_t HandlerPC(intptr_t index) const;
 
   void SetHandlerEntry(intptr_t index,
                        intptr_t try_index,
                        intptr_t handler_pc) const {
     SetTryIndex(index, try_index);
     SetHandlerPC(index, handler_pc);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ExceptionHandlers);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawExceptionHandlers) == OFFSET_OF(RawExceptionHandlers,
                                                      data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawExceptionHandlers) +
-                                 (len * kNumberOfEntries * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawExceptionHandlers) + (len * kBytesPerElement));
   }
 
   static RawExceptionHandlers* New(intptr_t num_handlers);
 
   // We would have a VisitPointers function here to traverse the
   // exception handler table to visit objects if any in the table.
 
  private:
-  // Describes the layout of exception handler data.
-  enum {
-    kTryIndexEntry = 0,  // Try block index associated with handler.
-    kHandlerPcEntry,  // PC value of handler.
-    kNumberOfEntries
-  };
-
   void SetTryIndex(intptr_t index, intptr_t value) const;
   void SetHandlerPC(intptr_t index, intptr_t value) const;
 
   void SetLength(intptr_t value) const;
 
   intptr_t* EntryAddr(intptr_t index, intptr_t entry_offset) const {
     ASSERT((index >=0) && (index < Length()));
     intptr_t data_index = (index * kNumberOfEntries) + entry_offset;
     return &raw_ptr()->data_[data_index];
   }
@@ skipping 90 matching lines @@
   RawFunction* function() const {
     return raw_ptr()->function_;
   }
   void set_function(const Function& function) const {
     StorePointer(&raw_ptr()->function_, function.raw());
   }
 
   // We would have a VisitPointers function here to traverse all the
   // embedded objects in the instructions using pointer_offsets.
 
+  static const intptr_t kBytesPerElement =
+      sizeof(reinterpret_cast<RawCode*>(0)->data_[0]);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Code);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawCode) == OFFSET_OF(RawCode, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t pointer_offsets_length) {
-    return RoundedAllocationSize(
-        sizeof(RawCode) + (pointer_offsets_length * kEntrySize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawCode) + (len * kBytesPerElement));
   }
   static RawCode* FinalizeCode(const Function& function, Assembler* assembler);
   static RawCode* FinalizeCode(const char* name, Assembler* assembler);
   static RawCode* LookupCode(uword pc);
 
   int32_t GetPointerOffsetAt(int index) const {
     return *PointerOffsetAddrAt(index);
   }
   intptr_t GetTokenIndexOfPC(uword pc) const;
 
@@ skipping 46 matching lines @@
     return &raw_ptr()->data_[index];
   }
   void SetPointerOffsetAt(int index, int32_t offset_in_instructions) {
     *PointerOffsetAddrAt(index) = offset_in_instructions;
   }
 
   // New is a private method as RawInstruction and RawCode objects should
   // only be created using the Code::FinalizeCode method. This method creates
   // the RawInstruction and RawCode objects, sets up the pointer offsets
   // and links the two in a GC safe manner.
-  static RawCode* New(int pointer_offsets_length);
+  static RawCode* New(intptr_t pointer_offsets_length);
 
   HEAP_OBJECT_IMPLEMENTATION(Code, Object);
   friend class Class;
 };
 
 
 class Context : public Object {
  public:
   RawContext* parent() const { return raw_ptr()->parent_; }
   void set_parent(const Context& parent) const {
     ASSERT(parent.IsNull() || parent.isolate() == Isolate::Current());
     StorePointer(&raw_ptr()->parent_, parent.raw());
   }
   static intptr_t parent_offset() { return OFFSET_OF(RawContext, parent_); }
 
   Isolate* isolate() const { return raw_ptr()->isolate_; }
   static intptr_t isolate_offset() { return OFFSET_OF(RawContext, isolate_); }
 
   intptr_t num_variables() const { return raw_ptr()->num_variables_; }
   static intptr_t num_variables_offset() {
     return OFFSET_OF(RawContext, num_variables_);
   }
 
   RawInstance* At(intptr_t context_index) const {
     return *InstanceAddr(context_index);
   }
   inline void SetAt(intptr_t context_index, const Instance& value) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Context);
+
   static intptr_t variable_offset(intptr_t context_index) {
     return OFFSET_OF(RawContext, data_[context_index]);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawContext) == OFFSET_OF(RawContext, data_));
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContext) +
-                                 (num_variables * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawContext) + (len * kBytesPerElement));
   }
 
   static RawContext* New(intptr_t num_variables,
                          Heap::Space space = Heap::kNew);
 
  private:
   RawInstance** InstanceAddr(intptr_t context_index) const {
     ASSERT((context_index >= 0) && (context_index < num_variables()));
     return &raw_ptr()->data_[context_index];
   }
@@ skipping 35 matching lines @@
 
   RawAbstractType* TypeAt(intptr_t scope_index) const;
   void SetTypeAt(intptr_t scope_index, const AbstractType& type) const;
 
   intptr_t ContextIndexAt(intptr_t scope_index) const;
   void SetContextIndexAt(intptr_t scope_index, intptr_t context_index) const;
 
   intptr_t ContextLevelAt(intptr_t scope_index) const;
   void SetContextLevelAt(intptr_t scope_index, intptr_t context_level) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawContextScope::VariableDesc);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ContextScope);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawContextScope) == OFFSET_OF(RawContextScope, data_));
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContextScope) +
-        (num_variables * sizeof(RawContextScope::VariableDesc)));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawContextScope) + (len * kBytesPerElement));
   }
 
   static RawContextScope* New(intptr_t num_variables);
 
  private:
   void set_num_variables(intptr_t num_variables) const {
     raw_ptr()->num_variables_ = num_variables;
   }
 
   RawContextScope::VariableDesc* VariableDescAddr(intptr_t index) const {
@@ skipping 450 matching lines @@
 
  private:
   void set_value(int64_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(Mint, Integer);
   friend class Class;
 };
 
 
 class Bigint : public Integer {
+ private:
+  typedef uint32_t Chunk;
+  typedef uint64_t DoubleChunk;
+  static const int kChunkSize = sizeof(Chunk);
+
  public:
   virtual bool IsZero() const { return raw_ptr()->signed_length_ == 0; }
   virtual bool IsNegative() const { return raw_ptr()->signed_length_ < 0; }
 
   virtual bool Equals(const Instance& other) const;
 
   virtual double AsDoubleValue() const;
   virtual int64_t AsInt64Value() const;
 
   virtual int CompareWith(const Integer& other) const;
 
-  static intptr_t InstanceSize(intptr_t length) {
-    ASSERT(length >= 0);
-    return RoundedAllocationSize(sizeof(RawBigint) + (length * sizeof(Chunk)));
+  static const intptr_t kBytesPerElement = kChunkSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Bigint);
+
+  static intptr_t InstanceSize() { return 0; }
+
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawBigint) + (len * kBytesPerElement));
   }
-  static intptr_t InstanceSize() { return 0; }
 
   static RawBigint* New(const String& str, Heap::Space space = Heap::kNew);
   static RawBigint* New(int64_t value, Heap::Space space = Heap::kNew);
 
  private:
-  typedef uint32_t Chunk;
-  typedef uint64_t DoubleChunk;
-  static const int kChunkSize = sizeof(Chunk);
-
   Chunk GetChunkAt(intptr_t i) const {
     return *ChunkAddr(i);
   }
 
   void SetChunkAt(intptr_t i, Chunk newValue) const {
     *ChunkAddr(i) = newValue;
   }
 
   // Returns the number of chunks in use.
   intptr_t Length() const {
@@ skipping 239 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kOneByteChar;
   }
 
   RawOneByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(OneByteString);
+
   static intptr_t data_offset() { return OFFSET_OF(RawOneByteString, data_); }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawOneByteString) == OFFSET_OF(RawOneByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawOneByteString) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawOneByteString) + (len * kBytesPerElement));
   }
 
   static RawOneByteString* New(intptr_t len,
                                Heap::Space space);
   static RawOneByteString* New(const uint8_t* characters,
                                intptr_t len,
                                Heap::Space space);
   static RawOneByteString* New(const uint16_t* characters,
                                intptr_t len,
                                Heap::Space space);
@@ skipping 32 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kTwoByteChar;
   }
 
   RawTwoByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TwoByteString);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTwoByteString) == OFFSET_OF(RawTwoByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTwoByteString) + (2 * len));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTwoByteString) + (len * kBytesPerElement));
   }
 
   static RawTwoByteString* New(intptr_t len,
                                Heap::Space space);
   static RawTwoByteString* New(const uint16_t* characters,
                                intptr_t len,
                                Heap::Space space);
   static RawTwoByteString* New(const uint32_t* characters,
                                intptr_t len,
                                Heap::Space space);
@@ skipping 28 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kFourByteChar;
   }
 
   RawFourByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(FourByteString);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFourByteString) == OFFSET_OF(RawFourByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawFourByteString) + (4 * len));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFourByteString) + (len * kBytesPerElement));
   }
 
   static RawFourByteString* New(intptr_t len,
                                 Heap::Space space);
   static RawFourByteString* New(const uint32_t* characters,
                                 intptr_t len,
                                 Heap::Space space);
   static RawFourByteString* New(const FourByteString& str,
                                 Heap::Space space);
 
@@ skipping 72 matching lines @@
 
   virtual intptr_t CharSize() const {
     return kTwoByteChar;
   }
 
   virtual bool IsExternal() const { return true; }
   virtual void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = (kIntptrMax / kBytesPerElement);
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalTwoByteString));
   }
 
   static RawExternalTwoByteString* New(const uint16_t* characters,
                                        intptr_t len,
                                        void* peer,
                                        Dart_PeerFinalizer callback,
                                        Heap::Space space = Heap::kNew);
 
@@ skipping 24 matching lines @@
 
   virtual intptr_t CharSize() const {
     return kFourByteChar;
   }
 
   virtual bool IsExternal() const { return true; }
   virtual void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = (kIntptrMax / kBytesPerElement);
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalFourByteString));
   }
 
   static RawExternalFourByteString* New(const uint32_t* characters,
                                         intptr_t len,
                                         void* peer,
                                         Dart_PeerFinalizer callback,
                                         Heap::Space space = Heap::kNew);
 
@@ skipping 64 matching lines @@
 
   virtual RawAbstractTypeArguments* GetTypeArguments() const {
     return raw_ptr()->type_arguments_;
   }
   virtual void SetTypeArguments(const AbstractTypeArguments& value) const {
     raw_ptr()->type_arguments_ = value.raw();
   }
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Array);
+
   static intptr_t type_arguments_offset() {
     return OFFSET_OF(RawArray, type_arguments_);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawArray) == OFFSET_OF_RETURNED_VALUE(RawArray, data));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that variable length data is not adding to the object length.
     ASSERT(sizeof(RawArray) == (sizeof(RawObject) + (2 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawArray) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawArray) + (len * kBytesPerElement));
   }
 
   // Make the array immutable to Dart code by switching the class pointer
   // to ImmutableArray.
   void MakeImmutable() const;
 
   static RawArray* New(intptr_t len, Heap::Space space = Heap::kNew);
 
   // Creates and returns a new array with 'new_length'. Copies all elements from
   // 'source' to the new array. 'new_length' must be greater than or equal to
@@ skipping 14 matching lines @@
   // collection. The backing array of the original Growable Object Array is
   // set to an empty array.
   static RawArray* MakeArray(const GrowableObjectArray& growable_array);
 
  protected:
   static RawArray* New(const Class& cls,
                        intptr_t len,
                        Heap::Space space = Heap::kNew);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxArrayElements = 512 * 1024 * 1024;
-
   RawObject** ObjectAddr(intptr_t index) const {
     // TODO(iposva): Determine if we should throw an exception here.
     ASSERT((index >= 0) && (index < Length()));
     return &raw_ptr()->data()[index];
   }
 
   void SetLength(intptr_t value) const {
     // This is only safe because we create a new Smi, which does not cause
     // heap allocation.
     raw_ptr()->length_ = Smi::New(value);
@@ skipping 181 matching lines @@
   int8_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt8Array) == OFFSET_OF(RawInt8Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawInt8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt8Array) + (len * kBytesPerElement));
   }
 
   static RawInt8Array* New(intptr_t len,
                            Heap::Space space = Heap::kNew);
   static RawInt8Array* New(const int8_t* data,
                            intptr_t len,
                            Heap::Space space = Heap::kNew);
 
  private:
   uint8_t* ByteAddr(intptr_t byte_offset) const {
@@ skipping 16 matching lines @@
   uint8_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint8Array) == OFFSET_OF(RawUint8Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawUint8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint8Array) + (len * kBytesPerElement));
   }
 
   static RawUint8Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawUint8Array* New(const uint8_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
   uint8_t* ByteAddr(intptr_t byte_offset) const {
@@ skipping 16 matching lines @@
   int16_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt16Array) == OFFSET_OF(RawInt16Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt16Array) + (len * kBytesPerElement));
   }
 
   static RawInt16Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt16Array* New(const int16_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int16Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint16Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   uint16_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint16Array) == OFFSET_OF(RawUint16Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint16Array) + (len * kBytesPerElement));
   }
 
   static RawUint16Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint16Array* New(const uint16_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint16Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Int32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   int32_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt32Array) == OFFSET_OF(RawInt32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt32Array) + (len * kBytesPerElement));
   }
 
   static RawInt32Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt32Array* New(const int32_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   uint32_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint32Array) == OFFSET_OF(RawUint32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint32Array) + (len * kBytesPerElement));
   }
 
   static RawUint32Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint32Array* New(const uint32_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Int64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   int64_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt64Array) == OFFSET_OF(RawInt64Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt64Array) + (len * kBytesPerElement));
   }
 
   static RawInt64Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt64Array* New(const int64_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * sizeof(uint64_t);
   }
 
   uint64_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint64Array) == OFFSET_OF(RawUint64Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint64Array) + (len * kBytesPerElement));
   }
 
   static RawUint64Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint64Array* New(const uint64_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Float32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   float At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, float value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFloat32Array) == OFFSET_OF(RawFloat32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat32Array) + (len * kBytesPerElement));
   }
 
   static RawFloat32Array* New(intptr_t len,
                               Heap::Space space = Heap::kNew);
   static RawFloat32Array* New(const float* data,
                               intptr_t len,
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Float32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Float64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   double At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, double value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float64Array);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFloat64Array) == OFFSET_OF(RawFloat64Array, data_));
     return 0;
   }
 
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat64Array) + (len * kBytesPerElement));
   }
 
   static RawFloat64Array* New(intptr_t len,
                               Heap::Space space = Heap::kNew);
   static RawFloat64Array* New(const double* data,
                               intptr_t len,
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Float64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
@@ skipping 613 matching lines @@
   void set_is_multi_line() const { raw_ptr()->flags_ |= kMultiLine; }
   void set_is_simple() const { raw_ptr()->type_ = kSimple; }
   void set_is_complex() const { raw_ptr()->type_ = kComplex; }
 
   void* GetDataStartAddress() const;
   static RawJSRegExp* FromDataStartAddress(void* data);
   const char* Flags() const;
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(JSRegExp);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawJSRegExp) == OFFSET_OF(RawJSRegExp, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawJSRegExp) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawJSRegExp) + (len * kBytesPerElement));
   }
 
   static RawJSRegExp* New(intptr_t length, Heap::Space space = Heap::kNew);
 
  private:
   void set_type(RegExType type) const { raw_ptr()->type_ = type; }
   void set_flags(intptr_t value) const { raw_ptr()->flags_ = value; }
 
   void SetLength(intptr_t value) const {
     // This is only safe because we create a new Smi, which does not cause
@@ skipping 80 matching lines @@
 }
 
 
 intptr_t Stackmap::SizeInBits() const {
   return (Smi::Value(raw_ptr()->bitmap_size_in_bytes_) * kBitsPerByte);
 }
 
 }  // namespace dart
 
 #endif  // VM_OBJECT_H_