Enforce length/size limits for variable size heap object in order to

vm/object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_OBJECT_H_
 #define VM_OBJECT_H_
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "platform/utils.h"
 #include "vm/bitmap.h"
 #include "vm/dart.h"
 #include "vm/globals.h"
 #include "vm/handles.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/os.h"
 #include "vm/raw_object.h"
 #include "vm/scanner.h"
 
 namespace dart {
 
+// Compute the maximum element count for a variable size type in order
+// to avoid integer overflow. We take into account header size,
+// rounding, and the bytes per element.
+#define MAX_ELEMENTS(type)                                                     \
+  ((kIntptrMax - sizeof(Raw##type) - sizeof(RawObject)) /                      \
+  type::kBytesPerElement)
+
 // Forward declarations.
 #define DEFINE_FORWARD_DECLARATION(clazz)                                      \
   class clazz;
 CLASS_LIST(DEFINE_FORWARD_DECLARATION)
 #undef DEFINE_FORWARD_DECLARATION
 class Api;
 class Assembler;
 class Code;
 class LocalScope;
 
@@ skipping 1160 matching lines @@
   virtual void SetTypeAt(intptr_t index, const AbstractType& value) const;
   virtual bool IsResolved() const;
   virtual bool IsInstantiated() const;
   virtual bool IsUninstantiatedIdentity() const;
   // Canonicalize only if instantiated, otherwise returns 'this'.
   virtual RawAbstractTypeArguments* Canonicalize() const;
 
   virtual RawAbstractTypeArguments* InstantiateFrom(
       const AbstractTypeArguments& instantiator_type_arguments) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TypeArguments);
+
   static intptr_t length_offset() {
     return OFFSET_OF(RawTypeArguments, length_);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTypeArguments) == OFFSET_OF(RawTypeArguments, types_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that the types_ is not adding to the object length.
     ASSERT(sizeof(RawTypeArguments) == (sizeof(RawObject) + (1 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawTypeArguments) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTypeArguments) + (len * kBytesPerElement));
   }
 
   static RawTypeArguments* New(intptr_t len, Heap::Space space = Heap::kOld);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxTypes = 512 * 1024 * 1024;
   RawAbstractType** TypeAddr(intptr_t index) const;
   void SetLength(intptr_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(TypeArguments, AbstractTypeArguments);
   friend class Class;
 };
 
 
 // An instance of InstantiatedTypeArguments is never encountered at compile
 // time, but only at run time, when type parameters can be matched to actual
@@ skipping 467 matching lines @@
  public:
   inline intptr_t Length() const;
 
   RawArray* TokenObjects() const;
   void SetTokenObjects(const Array& value) const;
 
   RawString* GenerateSource() const;
   intptr_t ComputeSourcePosition(intptr_t tok_pos) const;
   intptr_t ComputeTokenPosition(intptr_t src_pos) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TokenStream);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTokenStream) == OFFSET_OF(RawTokenStream, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTokenStream) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTokenStream) + (len * kBytesPerElement));
   }
 
   static RawTokenStream* New(intptr_t length);
   static RawTokenStream* New(const Scanner::GrowableTokenStream& tokens);
 
   // The class Iterator encapsulates iteration over the tokens
   // in a TokenStream object.
   class Iterator : ValueObject {
    public:
     Iterator(const TokenStream& tokens, intptr_t token_pos);
@@ skipping 314 matching lines @@
 
 class Instructions : public Object {
  public:
   intptr_t size() const { return raw_ptr()->size_; }
   RawCode* code() const { return raw_ptr()->code_; }
 
   uword EntryPoint() const {
     return reinterpret_cast<uword>(raw_ptr()) + HeaderSize();
   }
 
+  static const intptr_t kMaxElements = (kIntptrMax -
+                                        (sizeof(RawInstructions) +
+                                         sizeof(RawObject) +
+                                         (2 * OS::kMaxPreferredCodeAlignment)));
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInstructions) == OFFSET_OF(RawInstructions, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t size) {
     intptr_t instructions_size = Utils::RoundUp(size,
                                                 OS::PreferredCodeAlignment());
     intptr_t result = instructions_size + HeaderSize();
     ASSERT(result % OS::PreferredCodeAlignment() == 0);
@@ skipping 35 matching lines @@
   intptr_t Length() const;
 
   RawString* GetName(intptr_t var_index) const;
 
   void SetVar(intptr_t var_index,
               const String& name,
               RawLocalVarDescriptors::VarInfo* info) const;
 
   void GetInfo(intptr_t var_index, RawLocalVarDescriptors::VarInfo* info) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawLocalVarDescriptors::VarInfo);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(LocalVarDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawLocalVarDescriptors) ==
         OFFSET_OF(RawLocalVarDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawLocalVarDescriptors) +
-        (len * sizeof(RawLocalVarDescriptors::VarInfo)));
+        sizeof(RawLocalVarDescriptors) + (len * kBytesPerElement));
   }
 
   static RawLocalVarDescriptors* New(intptr_t num_variables);
 
  private:
   HEAP_OBJECT_IMPLEMENTATION(LocalVarDescriptors, Object);
   friend class Class;
 };
 
 
 class PcDescriptors : public Object {
+ private:
+  // Describes the layout of PC descriptor data.
+  enum {
+    kPcEntry = 0,      // PC value of the descriptor, unique.
+    kKindEntry,
+    kNodeIdEntry,      // AST node id.
+    kTokenIndexEntry,  // Token position in source of PC.
+    kTryIndexEntry,    // Try block index of PC.
+    // We would potentially be adding other objects here like
+    // pointer maps for optimized functions, local variables information  etc.
+    kNumberOfEntries
+  };
+
  public:
   enum Kind {
     kDeopt = 0,  // Deoptimization cotinuation point.
     kPatchCode,  // Buffer for patching code entry.
     kIcCall,     // IC call.
     kFuncCall,   // Call to known target, e.g. static call, closure call.
     kReturn,     // Return from function.
     kOther
   };
 
@@ skipping 12 matching lines @@
                      intptr_t node_id,
                      intptr_t token_pos,
                      intptr_t try_index) const {
     SetPC(index, pc);
     SetKind(index, kind);
     SetNodeId(index, node_id);
     SetTokenIndex(index, token_pos);
     SetTryIndex(index, try_index);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(PcDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawPcDescriptors) == OFFSET_OF(RawPcDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawPcDescriptors) + (len * kNumberOfEntries * kWordSize));
+        sizeof(RawPcDescriptors) + (len * kBytesPerElement));
   }
 
   static RawPcDescriptors* New(intptr_t num_descriptors);
 
   // Verify (assert) assumptions about pc descriptors in debug mode.
   void Verify(bool check_ids) const;
 
   // We would have a VisitPointers function here to traverse the
   // pc descriptors table to visit objects if any in the table.
 
  private:
-  // Describes the layout of PC descriptor data.
-  enum {
-    kPcEntry = 0,      // PC value of the descriptor, unique.
-    kKindEntry,
-    kNodeIdEntry,      // AST node id.
-    kTokenIndexEntry,  // Token position in source of PC.
-    kTryIndexEntry,    // Try block index of PC.
-    // We would potentially be adding other objects here like
-    // pointer maps for optimized functions, local variables information  etc.
-    kNumberOfEntries
-  };
-
   void SetPC(intptr_t index, uword value) const;
   void SetKind(intptr_t index, PcDescriptors::Kind kind) const;
   void SetNodeId(intptr_t index, intptr_t value) const;
   void SetTokenIndex(intptr_t index, intptr_t value) const;
   void SetTryIndex(intptr_t index, intptr_t value) const;
 
   void SetLength(intptr_t value) const;
 
   intptr_t* EntryAddr(intptr_t index, intptr_t entry_offset) const {
     ASSERT((index >=0) && (index < Length()));
@@ skipping 22 matching lines @@
 
   RawCode* GetCode() const { return raw_ptr()->code_; }
   void SetCode(const Code& code) const;
 
   // Return the offset of the highest stack slot that has an object.
   intptr_t MaximumBitOffset() const { return raw_ptr()->max_set_bit_offset_; }
 
   // Return the offset of the lowest stack slot that has an object.
   intptr_t MinimumBitOffset() const { return raw_ptr()->min_set_bit_offset_; }
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Stackmap);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawStackmap) == OFFSET_OF(RawStackmap, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t size) {
-    return RoundedAllocationSize(sizeof(RawStackmap) + (size * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawStackmap) + (len * kBytesPerElement));
   }
   static RawStackmap* New(uword pc, BitmapBuilder* bmap);
 
  private:
   inline intptr_t SizeInBits() const;
 
   void SetMinBitOffset(intptr_t value) const {
     raw_ptr()->min_set_bit_offset_ = value;
   }
   void SetMaxBitOffset(intptr_t value) const {
     raw_ptr()->max_set_bit_offset_ = value;
   }
 
   bool InRange(intptr_t offset) const { return offset < SizeInBits(); }
 
   bool GetBit(intptr_t bit_offset) const;
   void SetBit(intptr_t bit_offset, bool value) const;
 
   void set_bitmap_size_in_bytes(intptr_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(Stackmap, Object);
   friend class Class;
   friend class BitmapBuilder;
 };
 
 
 class ExceptionHandlers : public Object {
+ private:
+  // Describes the layout of exception handler data.
+  enum {
+    kTryIndexEntry = 0,  // Try block index associated with handler.
+    kHandlerPcEntry,  // PC value of handler.
+    kNumberOfEntries
+  };
+
  public:
   intptr_t Length() const;
 
   intptr_t TryIndex(intptr_t index) const;
   intptr_t HandlerPC(intptr_t index) const;
 
   void SetHandlerEntry(intptr_t index,
                        intptr_t try_index,
                        intptr_t handler_pc) const {
     SetTryIndex(index, try_index);
     SetHandlerPC(index, handler_pc);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ExceptionHandlers);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawExceptionHandlers) == OFFSET_OF(RawExceptionHandlers,
                                                      data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawExceptionHandlers) +
-                                 (len * kNumberOfEntries * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawExceptionHandlers) + (len * kBytesPerElement));
   }
 
   static RawExceptionHandlers* New(intptr_t num_handlers);
 
   // We would have a VisitPointers function here to traverse the
   // exception handler table to visit objects if any in the table.
 
  private:
-  // Describes the layout of exception handler data.
-  enum {
-    kTryIndexEntry = 0,  // Try block index associated with handler.
-    kHandlerPcEntry,  // PC value of handler.
-    kNumberOfEntries
-  };
-
   void SetTryIndex(intptr_t index, intptr_t value) const;
   void SetHandlerPC(intptr_t index, intptr_t value) const;
 
   void SetLength(intptr_t value) const;
 
   intptr_t* EntryAddr(intptr_t index, intptr_t entry_offset) const {
     ASSERT((index >=0) && (index < Length()));
     intptr_t data_index = (index * kNumberOfEntries) + entry_offset;
     return &raw_ptr()->data_[data_index];
   }
@@ skipping 90 matching lines @@
   RawFunction* function() const {
     return raw_ptr()->function_;
   }
   void set_function(const Function& function) const {
     StorePointer(&raw_ptr()->function_, function.raw());
   }
 
   // We would have a VisitPointers function here to traverse all the
   // embedded objects in the instructions using pointer_offsets.
 
+  static const intptr_t kBytesPerElement =
+      sizeof(reinterpret_cast<RawCode*>(0)->data_[0]);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Code);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawCode) == OFFSET_OF(RawCode, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t pointer_offsets_length) {
-    return RoundedAllocationSize(
-        sizeof(RawCode) + (pointer_offsets_length * kEntrySize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawCode) + (len * kBytesPerElement));
   }
   static RawCode* FinalizeCode(const Function& function, Assembler* assembler);
   static RawCode* FinalizeCode(const char* name, Assembler* assembler);
   static RawCode* LookupCode(uword pc);
 
   int32_t GetPointerOffsetAt(int index) const {
     return *PointerOffsetAddrAt(index);
   }
   intptr_t GetTokenIndexOfPC(uword pc) const;
 
@@ skipping 46 matching lines @@
     return &raw_ptr()->data_[index];
   }
   void SetPointerOffsetAt(int index, int32_t offset_in_instructions) {
     *PointerOffsetAddrAt(index) = offset_in_instructions;
   }
 
   // New is a private method as RawInstruction and RawCode objects should
   // only be created using the Code::FinalizeCode method. This method creates
   // the RawInstruction and RawCode objects, sets up the pointer offsets
   // and links the two in a GC safe manner.
-  static RawCode* New(int pointer_offsets_length);
+  static RawCode* New(intptr_t pointer_offsets_length);
 
   HEAP_OBJECT_IMPLEMENTATION(Code, Object);
   friend class Class;
 };
 
 
 class Context : public Object {
  public:
   RawContext* parent() const { return raw_ptr()->parent_; }
   void set_parent(const Context& parent) const {
     ASSERT(parent.IsNull() || parent.isolate() == Isolate::Current());
     StorePointer(&raw_ptr()->parent_, parent.raw());
   }
   static intptr_t parent_offset() { return OFFSET_OF(RawContext, parent_); }
 
   Isolate* isolate() const { return raw_ptr()->isolate_; }
   static intptr_t isolate_offset() { return OFFSET_OF(RawContext, isolate_); }
 
   intptr_t num_variables() const { return raw_ptr()->num_variables_; }
   static intptr_t num_variables_offset() {
     return OFFSET_OF(RawContext, num_variables_);
   }
 
   RawInstance* At(intptr_t context_index) const {
     return *InstanceAddr(context_index);
   }
   inline void SetAt(intptr_t context_index, const Instance& value) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Context);
+
   static intptr_t variable_offset(intptr_t context_index) {
     return OFFSET_OF(RawContext, data_[context_index]);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawContext) == OFFSET_OF(RawContext, data_));
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContext) +
-                                 (num_variables * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawContext) + (len * kBytesPerElement));
   }
 
   static RawContext* New(intptr_t num_variables,
                          Heap::Space space = Heap::kNew);
 
  private:
   RawInstance** InstanceAddr(intptr_t context_index) const {
     ASSERT((context_index >= 0) && (context_index < num_variables()));
     return &raw_ptr()->data_[context_index];
   }
@@ skipping 35 matching lines @@
 
   RawAbstractType* TypeAt(intptr_t scope_index) const;
   void SetTypeAt(intptr_t scope_index, const AbstractType& type) const;
 
   intptr_t ContextIndexAt(intptr_t scope_index) const;
   void SetContextIndexAt(intptr_t scope_index, intptr_t context_index) const;
 
   intptr_t ContextLevelAt(intptr_t scope_index) const;
   void SetContextLevelAt(intptr_t scope_index, intptr_t context_level) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawContextScope::VariableDesc);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ContextScope);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawContextScope) == OFFSET_OF(RawContextScope, data_));
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContextScope) +
-        (num_variables * sizeof(RawContextScope::VariableDesc)));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawContextScope) + (len * kBytesPerElement));
   }
 
   static RawContextScope* New(intptr_t num_variables);
 
  private:
   void set_num_variables(intptr_t num_variables) const {
     raw_ptr()->num_variables_ = num_variables;
   }
 
   RawContextScope::VariableDesc* VariableDescAddr(intptr_t index) const {
@@ skipping 450 matching lines @@
 
  private:
   void set_value(int64_t value) const;
 
   HEAP_OBJECT_IMPLEMENTATION(Mint, Integer);
   friend class Class;
 };
 
 
 class Bigint : public Integer {
+ private:
+  typedef uint32_t Chunk;
+  typedef uint64_t DoubleChunk;
+  static const int kChunkSize = sizeof(Chunk);
+
  public:
   virtual bool IsZero() const { return raw_ptr()->signed_length_ == 0; }
   virtual bool IsNegative() const { return raw_ptr()->signed_length_ < 0; }
 
   virtual bool Equals(const Instance& other) const;
 
   virtual double AsDoubleValue() const;
   virtual int64_t AsInt64Value() const;
 
   virtual int CompareWith(const Integer& other) const;
 
-  static intptr_t InstanceSize(intptr_t length) {
-    ASSERT(length >= 0);
-    return RoundedAllocationSize(sizeof(RawBigint) + (length * sizeof(Chunk)));
+  static const intptr_t kBytesPerElement = kChunkSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Bigint);
+
+  static intptr_t InstanceSize() { return 0; }
+
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawBigint) + (len * kBytesPerElement));
   }
-  static intptr_t InstanceSize() { return 0; }
 
   static RawBigint* New(const String& str, Heap::Space space = Heap::kNew);
   static RawBigint* New(int64_t value, Heap::Space space = Heap::kNew);
 
  private:
-  typedef uint32_t Chunk;
-  typedef uint64_t DoubleChunk;
-  static const int kChunkSize = sizeof(Chunk);
-
   Chunk GetChunkAt(intptr_t i) const {
     return *ChunkAddr(i);
   }
 
   void SetChunkAt(intptr_t i, Chunk newValue) const {
     *ChunkAddr(i) = newValue;
   }
 
   // Returns the number of chunks in use.
   intptr_t Length() const {
@@ skipping 73 matching lines @@
 class String : public Instance {
  public:
   // We use 30 bits for the hash code so that we consistently use a
   // 32bit Smi representation for the hash code on all architectures.
   static const intptr_t kHashBits = 30;
 
   static const intptr_t kOneByteChar = 1;
   static const intptr_t kTwoByteChar = 2;
   static const intptr_t kFourByteChar = 4;
 
+  // All strings share the same maximum element count to keep things
+  // simple.  We choose a value that will prevent integer overflow for
+  // 4 byte strings, since it is the worst case.
+  static const intptr_t kSizeofRawString = sizeof(RawObject) + (2 * kWordSize);
+  static const intptr_t kMaxElements =
+      (kIntptrMax - kSizeofRawString - sizeof(RawObject)) / kFourByteChar;
+
   intptr_t Length() const { return Smi::Value(raw_ptr()->length_); }
   static intptr_t length_offset() { return OFFSET_OF(RawString, length_); }
 
   virtual intptr_t Hash() const;
   static intptr_t hash_offset() { return OFFSET_OF(RawString, hash_); }
   static intptr_t Hash(const String& str, intptr_t begin_index, intptr_t len);
   static intptr_t Hash(const uint8_t* characters, intptr_t len);
   static intptr_t Hash(const uint16_t* characters, intptr_t len);
   static intptr_t Hash(const uint32_t* characters, intptr_t len);
 
@@ skipping 146 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kOneByteChar;
   }
 
   RawOneByteString* EscapeDoubleQuotes() const;
 
+  // We use the same maximum elements for all strings.
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t data_offset() { return OFFSET_OF(RawOneByteString, data_); }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawOneByteString) == OFFSET_OF(RawOneByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawOneByteString) + len);
+    ASSERT(sizeof(RawOneByteString) == kSizeofRawString);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawOneByteString) + (len * kBytesPerElement));
   }
 
   static RawOneByteString* New(intptr_t len,
                                Heap::Space space);
   static RawOneByteString* New(const uint8_t* characters,
                                intptr_t len,
                                Heap::Space space);
   static RawOneByteString* New(const uint16_t* characters,
                                intptr_t len,
                                Heap::Space space);
@@ skipping 32 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kTwoByteChar;
   }
 
   RawTwoByteString* EscapeDoubleQuotes() const;
 
+  // We use the same maximum elements for all strings.
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTwoByteString) == OFFSET_OF(RawTwoByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTwoByteString) + (2 * len));
+    ASSERT(sizeof(RawTwoByteString) == kSizeofRawString);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTwoByteString) + (len * kBytesPerElement));
   }
 
   static RawTwoByteString* New(intptr_t len,
                                Heap::Space space);
   static RawTwoByteString* New(const uint16_t* characters,
                                intptr_t len,
                                Heap::Space space);
   static RawTwoByteString* New(const uint32_t* characters,
                                intptr_t len,
                                Heap::Space space);
@@ skipping 28 matching lines @@
   virtual int32_t CharAt(intptr_t index) const {
     return *CharAddr(index);
   }
 
   virtual intptr_t CharSize() const {
     return kFourByteChar;
   }
 
   RawFourByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFourByteString) == OFFSET_OF(RawFourByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawFourByteString) + (4 * len));
+    ASSERT(sizeof(RawTwoByteString) == kSizeofRawString);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFourByteString) + (len * kBytesPerElement));
   }
 
   static RawFourByteString* New(intptr_t len,
                                 Heap::Space space);
   static RawFourByteString* New(const uint32_t* characters,
                                 intptr_t len,
                                 Heap::Space space);
   static RawFourByteString* New(const FourByteString& str,
                                 Heap::Space space);
 
@@ skipping 28 matching lines @@
 
   virtual intptr_t CharSize() const {
     return kOneByteChar;
   }
 
   virtual bool IsExternal() const { return true; }
   virtual void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  // We use the same maximum elements for all strings.
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalOneByteString));
   }
 
   static RawExternalOneByteString* New(const uint8_t* characters,
                                        intptr_t len,
                                        void* peer,
                                        Dart_PeerFinalizer callback,
                                        Heap::Space space);
 
@@ skipping 24 matching lines @@
 
   virtual intptr_t CharSize() const {
     return kTwoByteChar;
   }
 
   virtual bool IsExternal() const { return true; }
   virtual void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  // We use the same maximum elements for all strings.
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalTwoByteString));
   }
 
   static RawExternalTwoByteString* New(const uint16_t* characters,
                                        intptr_t len,
                                        void* peer,
                                        Dart_PeerFinalizer callback,
                                        Heap::Space space = Heap::kNew);
 
@@ skipping 24 matching lines @@
 
   virtual intptr_t CharSize() const {
     return kFourByteChar;
   }
 
   virtual bool IsExternal() const { return true; }
   virtual void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  // We use the same maximum elements for all strings.
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = String::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalFourByteString));
   }
 
   static RawExternalFourByteString* New(const uint32_t* characters,
                                         intptr_t len,
                                         void* peer,
                                         Dart_PeerFinalizer callback,
                                         Heap::Space space = Heap::kNew);
 
@@ skipping 64 matching lines @@
 
   virtual RawAbstractTypeArguments* GetTypeArguments() const {
     return raw_ptr()->type_arguments_;
   }
   virtual void SetTypeArguments(const AbstractTypeArguments& value) const {
     raw_ptr()->type_arguments_ = value.raw();
   }
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Array);
+
   static intptr_t type_arguments_offset() {
     return OFFSET_OF(RawArray, type_arguments_);
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawArray) == OFFSET_OF_RETURNED_VALUE(RawArray, data));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that variable length data is not adding to the object length.
     ASSERT(sizeof(RawArray) == (sizeof(RawObject) + (2 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawArray) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawArray) + (len * kBytesPerElement));
   }
 
   // Make the array immutable to Dart code by switching the class pointer
   // to ImmutableArray.
   void MakeImmutable() const;
 
   static RawArray* New(intptr_t len, Heap::Space space = Heap::kNew);
 
   // Creates and returns a new array with 'new_length'. Copies all elements from
   // 'source' to the new array. 'new_length' must be greater than or equal to
@@ skipping 14 matching lines @@
   // collection. The backing array of the original Growable Object Array is
   // set to an empty array.
   static RawArray* MakeArray(const GrowableObjectArray& growable_array);
 
  protected:
   static RawArray* New(const Class& cls,
                        intptr_t len,
                        Heap::Space space = Heap::kNew);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxArrayElements = 512 * 1024 * 1024;
-
   RawObject** ObjectAddr(intptr_t index) const {
     // TODO(iposva): Determine if we should throw an exception here.
     ASSERT((index >= 0) && (index < Length()));
     return &raw_ptr()->data()[index];
   }
 
   void SetLength(intptr_t value) const {
     // This is only safe because we create a new Smi, which does not cause
     // heap allocation.
     raw_ptr()->length_ = Smi::New(value);
@@ skipping 181 matching lines @@
   int8_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt8Array) == OFFSET_OF(RawInt8Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawInt8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt8Array) + (len * kBytesPerElement));
   }
 
   static RawInt8Array* New(intptr_t len,
                            Heap::Space space = Heap::kNew);
   static RawInt8Array* New(const int8_t* data,
                            intptr_t len,
                            Heap::Space space = Heap::kNew);
 
  private:
   uint8_t* ByteAddr(intptr_t byte_offset) const {
@@ skipping 16 matching lines @@
   uint8_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint8Array) == OFFSET_OF(RawUint8Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawUint8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint8Array) + (len * kBytesPerElement));
   }
 
   static RawUint8Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawUint8Array* New(const uint8_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
   uint8_t* ByteAddr(intptr_t byte_offset) const {
@@ skipping 16 matching lines @@
   int16_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt16Array) == OFFSET_OF(RawInt16Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt16Array) + (len * kBytesPerElement));
   }
 
   static RawInt16Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt16Array* New(const int16_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int16Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint16Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   uint16_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint16Array) == OFFSET_OF(RawUint16Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint16Array) + (len * kBytesPerElement));
   }
 
   static RawUint16Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint16Array* New(const uint16_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint16Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Int32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   int32_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt32Array) == OFFSET_OF(RawInt32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt32Array) + (len * kBytesPerElement));
   }
 
   static RawInt32Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt32Array* New(const int32_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   uint32_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint32Array) == OFFSET_OF(RawUint32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint32Array) + (len * kBytesPerElement));
   }
 
   static RawUint32Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint32Array* New(const uint32_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Int64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   int64_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, int64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInt64Array) == OFFSET_OF(RawInt64Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt64Array) + (len * kBytesPerElement));
   }
 
   static RawInt64Array* New(intptr_t len,
                             Heap::Space space = Heap::kNew);
   static RawInt64Array* New(const int64_t* data,
                             intptr_t len,
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Int64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Uint64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * sizeof(uint64_t);
   }
 
   uint64_t At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, uint64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawUint64Array) == OFFSET_OF(RawUint64Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint64Array) + (len * kBytesPerElement));
   }
 
   static RawUint64Array* New(intptr_t len,
                              Heap::Space space = Heap::kNew);
   static RawUint64Array* New(const uint64_t* data,
                              intptr_t len,
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Uint64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Float32Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   float At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, float value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFloat32Array) == OFFSET_OF(RawFloat32Array, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat32Array) + (len * kBytesPerElement));
   }
 
   static RawFloat32Array* New(intptr_t len,
                               Heap::Space space = Heap::kNew);
   static RawFloat32Array* New(const float* data,
                               intptr_t len,
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Float32Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
 
 class Float64Array : public ByteArray {
  public:
   intptr_t ByteLength() const {
     return Length() * kBytesPerElement;
   }
 
   double At(intptr_t index) const {
     ASSERT((index >= 0) && (index < Length()));
     return raw_ptr()->data_[index];
   }
 
   void SetAt(intptr_t index, double value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float64Array);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFloat64Array) == OFFSET_OF(RawFloat64Array, data_));
     return 0;
   }
 
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat64Array) + (len * kBytesPerElement));
   }
 
   static RawFloat64Array* New(intptr_t len,
                               Heap::Space space = Heap::kNew);
   static RawFloat64Array* New(const double* data,
                               intptr_t len,
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
   }
 
   HEAP_OBJECT_IMPLEMENTATION(Float64Array, ByteArray);
   friend class ByteArray;
   friend class Class;
 };
 
@@ skipping 11 matching lines @@
 
   void SetAt(intptr_t index, int8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 1;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Int8Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalInt8Array));
   }
 
   static RawExternalInt8Array* New(int8_t* data,
                                    intptr_t len,
                                    void* peer,
                                    Dart_PeerFinalizer callback,
                                    Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 1;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<int8_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, uint8_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 1;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Uint8Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalUint8Array));
   }
 
   static RawExternalUint8Array* New(uint8_t* data,
                                     intptr_t len,
                                     void* peer,
                                     Dart_PeerFinalizer callback,
                                     Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 1;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<uint8_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 2;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Int16Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalInt16Array));
   }
 
   static RawExternalInt16Array* New(int16_t* data,
                                     intptr_t len,
                                     void* peer,
                                     Dart_PeerFinalizer callback,
                                     Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<int16_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int16_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 2;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Uint16Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalUint16Array));
   }
 
   static RawExternalUint16Array* New(uint16_t* data,
                                      intptr_t len,
                                      void* peer,
                                      Dart_PeerFinalizer callback,
                                      Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<uint16_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 4;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Int32Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalInt32Array));
   }
 
   static RawExternalInt32Array* New(int32_t* data,
                                     intptr_t len,
                                     void* peer,
                                     Dart_PeerFinalizer callback,
                                     Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<int32_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int32_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 4;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Uint32Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalUint32Array));
   }
 
   static RawExternalUint32Array* New(uint32_t* data,
                                      intptr_t len,
                                      void* peer,
                                      Dart_PeerFinalizer callback,
                                      Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<uint32_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 8;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Int64Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalInt64Array));
   }
 
   static RawExternalInt64Array* New(int64_t* data,
                                     intptr_t len,
                                     void* peer,
                                     Dart_PeerFinalizer callback,
                                     Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<int64_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, int64_t value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 8;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Uint64Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalUint64Array));
   }
 
   static RawExternalUint64Array* New(uint64_t* data,
                                      intptr_t len,
                                      void* peer,
                                      Dart_PeerFinalizer callback,
                                      Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<uint64_t>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, float value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 4;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Float32Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalFloat32Array));
   }
 
   static RawExternalFloat32Array* New(float* data,
                                       intptr_t len,
                                       void* peer,
                                       Dart_PeerFinalizer callback,
                                       Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<float>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 17 matching lines @@
 
   void SetAt(intptr_t index, double value) const {
     ASSERT((index >= 0) && (index < Length()));
     raw_ptr()->external_data_->data()[index] = value;
   }
 
   void* GetPeer() const {
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 8;
+
+  // Since external arrays may be serialized to non-external ones,
+  // enforce the same maximum element count.
+  static const intptr_t kMaxElements = Float64Array::kMaxElements;
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalFloat64Array));
   }
 
   static RawExternalFloat64Array* New(double* data,
                                       intptr_t len,
                                       void* peer,
                                       Dart_PeerFinalizer callback,
                                       Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     uint8_t* data =
         reinterpret_cast<uint8_t*>(raw_ptr()->external_data_->data());
     return data + byte_offset;
   }
 
   void SetExternalData(ExternalByteArrayData<double>* data) {
     raw_ptr()->external_data_ = data;
   }
@@ skipping 119 matching lines @@
   void set_is_multi_line() const { raw_ptr()->flags_ |= kMultiLine; }
   void set_is_simple() const { raw_ptr()->type_ = kSimple; }
   void set_is_complex() const { raw_ptr()->type_ = kComplex; }
 
   void* GetDataStartAddress() const;
   static RawJSRegExp* FromDataStartAddress(void* data);
   const char* Flags() const;
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(JSRegExp);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawJSRegExp) == OFFSET_OF(RawJSRegExp, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawJSRegExp) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawJSRegExp) + (len * kBytesPerElement));
   }
 
   static RawJSRegExp* New(intptr_t length, Heap::Space space = Heap::kNew);
 
  private:
   void set_type(RegExType type) const { raw_ptr()->type_ = type; }
   void set_flags(intptr_t value) const { raw_ptr()->flags_ = value; }
 
   void SetLength(intptr_t value) const {
     // This is only safe because we create a new Smi, which does not cause
@@ skipping 80 matching lines @@
 }
 
 
 intptr_t Stackmap::SizeInBits() const {
   return (Smi::Value(raw_ptr()->bitmap_size_in_bytes_) * kBitsPerByte);
 }
 
 }  // namespace dart
 
 #endif  // VM_OBJECT_H_