Enforce length/size limits for variable size heap object in order to

vm/object.h

Index: vm/object.h
===================================================================
--- vm/object.h	(revision 9641)
+++ vm/object.h	(working copy)
@@ -20,6 +20,10 @@
 
 namespace dart {
 
+#define MAX_ELEMENTS(type)                                                     \
+  ((kIntptrMax - sizeof(Raw##type) - sizeof(RawObject)) /                      \

[cshapiro, 2012/07/17 22:54:30]

Give consideration to the maximum value of a Smi.

[turnidge, 2012/07/18 18:17:04]

This is awkward to do, since the Smi::MaxValue isn't defined yet at this point.

...

Are you sure we need to check this here?  My goal is to prevent overflow of the
intptr_t type used to compute instance sizes.  Is there any reason why I should
need to enforce the Smi max here?

[cshapiro, 2012/07/19 05:49:01]

I lost an earlier comment.  It may appear after I publish, sorry if there is any
confusion.

Maybe I am totally wrong about this but as I see it MAX_ELEMENTS will over
estimate the maximum number of elements in a collection of a given element
width.  As such, I am not entirely enthusiastic about it in its current form,
its name, or the kMaxElements name.

For example, the maximum number of elements of an Int8Array or Uint8Array is the
maximum Smi value as we do not permit a Bigint valued index.  The Smi range is
always half the intptr_t range and, as such, MAX_ELEMENTS will always
over-estimate its value to be outside the Smi range, ((0x7FFFFFFF - 8 - 4) / 1)
> 0x3fffffff  

I think it would be a little bit simpler to have max value be computed as
follows

  (Smi::kMaxValue >> 0) for  8-bit elements
  (Smi::kMaxValue >> 1) for 16-bit elements
  (Smi::kMaxValue >> 2) for 32-bit elements 
  (Smi::kMaxValue >> 3) for 64-bit elements  

The halving of the range of a Smi versus inptr_t provides enough slop to
discount header sizes entirely.  Furthemore, kMaxElements can be encoded as a
Smi without overflowing to a Bigint.

[turnidge, 2012/07/31 23:21:45]

Done.

+  type::kBytesPerElement)
+
 // Forward declarations.
 #define DEFINE_FORWARD_DECLARATION(clazz)                                      \
   class clazz;
@@ -1200,6 +1204,9 @@
   virtual RawAbstractTypeArguments* InstantiateFrom(
       const AbstractTypeArguments& instantiator_type_arguments) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TypeArguments);
+
   static intptr_t length_offset() {
     return OFFSET_OF(RawTypeArguments, length_);
   }
@@ -1212,14 +1219,14 @@
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that the types_ is not adding to the object length.
     ASSERT(sizeof(RawTypeArguments) == (sizeof(RawObject) + (1 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawTypeArguments) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTypeArguments) + (len * kBytesPerElement));
   }
 
   static RawTypeArguments* New(intptr_t len, Heap::Space space = Heap::kOld);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxTypes = 512 * 1024 * 1024;
   RawAbstractType** TypeAddr(intptr_t index) const;
   void SetLength(intptr_t value) const;
 
@@ -1707,12 +1714,17 @@
   intptr_t ComputeSourcePosition(intptr_t tok_pos) const;
   intptr_t ComputeTokenPosition(intptr_t src_pos) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TokenStream);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTokenStream) == OFFSET_OF(RawTokenStream, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTokenStream) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTokenStream) + (len * kBytesPerElement));
   }
 
   static RawTokenStream* New(intptr_t length);
@@ -2047,6 +2059,11 @@
     return reinterpret_cast<uword>(raw_ptr()) + HeaderSize();
   }
 
+  static const intptr_t kMaxElements = (kIntptrMax -
+                                        (sizeof(RawInstructions) +
+                                         sizeof(RawObject) +
+                                         (2 * OS::kMaxPreferredCodeAlignment)));
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawInstructions) == OFFSET_OF(RawInstructions, data_));
     return 0;
@@ -2102,15 +2119,19 @@
 
   void GetInfo(intptr_t var_index, RawLocalVarDescriptors::VarInfo* info) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawLocalVarDescriptors::VarInfo);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(LocalVarDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawLocalVarDescriptors) ==
         OFFSET_OF(RawLocalVarDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawLocalVarDescriptors) +
-        (len * sizeof(RawLocalVarDescriptors::VarInfo)));
+        sizeof(RawLocalVarDescriptors) + (len * kBytesPerElement));
   }
 
   static RawLocalVarDescriptors* New(intptr_t num_variables);
@@ -2122,6 +2143,19 @@
 
 
 class PcDescriptors : public Object {
+ private:
+  // Describes the layout of PC descriptor data.
+  enum {
+    kPcEntry = 0,      // PC value of the descriptor, unique.
+    kKindEntry,
+    kNodeIdEntry,      // AST node id.
+    kTokenIndexEntry,  // Token position in source of PC.
+    kTryIndexEntry,    // Try block index of PC.
+    // We would potentially be adding other objects here like
+    // pointer maps for optimized functions, local variables information  etc.
+    kNumberOfEntries
+  };
+
  public:
   enum Kind {
     kDeopt = 0,  // Deoptimization cotinuation point.
@@ -2154,13 +2188,17 @@
     SetTryIndex(index, try_index);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(PcDescriptors);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawPcDescriptors) == OFFSET_OF(RawPcDescriptors, data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
     return RoundedAllocationSize(
-        sizeof(RawPcDescriptors) + (len * kNumberOfEntries * kWordSize));
+        sizeof(RawPcDescriptors) + (len * kBytesPerElement));
   }
 
   static RawPcDescriptors* New(intptr_t num_descriptors);
@@ -2172,18 +2210,6 @@
   // pc descriptors table to visit objects if any in the table.
 
  private:
-  // Describes the layout of PC descriptor data.
-  enum {
-    kPcEntry = 0,      // PC value of the descriptor, unique.
-    kKindEntry,
-    kNodeIdEntry,      // AST node id.
-    kTokenIndexEntry,  // Token position in source of PC.
-    kTryIndexEntry,    // Try block index of PC.
-    // We would potentially be adding other objects here like
-    // pointer maps for optimized functions, local variables information  etc.
-    kNumberOfEntries
-  };
-
   void SetPC(intptr_t index, uword value) const;
   void SetKind(intptr_t index, PcDescriptors::Kind kind) const;
   void SetNodeId(intptr_t index, intptr_t value) const;
@@ -2226,12 +2252,17 @@
   // Return the offset of the lowest stack slot that has an object.
   intptr_t MinimumBitOffset() const { return raw_ptr()->min_set_bit_offset_; }
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Stackmap);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawStackmap) == OFFSET_OF(RawStackmap, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t size) {
-    return RoundedAllocationSize(sizeof(RawStackmap) + (size * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawStackmap) + (len * kBytesPerElement));
   }
   static RawStackmap* New(uword pc, BitmapBuilder* bmap);
 
@@ -2259,6 +2290,14 @@
 
 
 class ExceptionHandlers : public Object {
+ private:
+  // Describes the layout of exception handler data.
+  enum {
+    kTryIndexEntry = 0,  // Try block index associated with handler.
+    kHandlerPcEntry,  // PC value of handler.
+    kNumberOfEntries
+  };
+
  public:
   intptr_t Length() const;
 
@@ -2272,14 +2311,18 @@
     SetHandlerPC(index, handler_pc);
   }
 
+  static const intptr_t kBytesPerElement = (kNumberOfEntries * kWordSize);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ExceptionHandlers);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawExceptionHandlers) == OFFSET_OF(RawExceptionHandlers,
                                                      data_));
     return 0;
   }
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawExceptionHandlers) +
-                                 (len * kNumberOfEntries * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawExceptionHandlers) + (len * kBytesPerElement));
   }
 
   static RawExceptionHandlers* New(intptr_t num_handlers);
@@ -2288,13 +2331,6 @@
   // exception handler table to visit objects if any in the table.
 
  private:
-  // Describes the layout of exception handler data.
-  enum {
-    kTryIndexEntry = 0,  // Try block index associated with handler.
-    kHandlerPcEntry,  // PC value of handler.
-    kNumberOfEntries
-  };
-
   void SetTryIndex(intptr_t index, intptr_t value) const;
   void SetHandlerPC(intptr_t index, intptr_t value) const;
 
@@ -2405,13 +2441,17 @@
   // We would have a VisitPointers function here to traverse all the
   // embedded objects in the instructions using pointer_offsets.
 
+  static const intptr_t kBytesPerElement =
+      sizeof(reinterpret_cast<RawCode*>(0)->data_[0]);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Code);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawCode) == OFFSET_OF(RawCode, data_));
     return 0;
   }
-  static intptr_t InstanceSize(intptr_t pointer_offsets_length) {
-    return RoundedAllocationSize(
-        sizeof(RawCode) + (pointer_offsets_length * kEntrySize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawCode) + (len * kBytesPerElement));
   }
   static RawCode* FinalizeCode(const Function& function, Assembler* assembler);
   static RawCode* FinalizeCode(const char* name, Assembler* assembler);
@@ -2478,7 +2518,7 @@
   // only be created using the Code::FinalizeCode method. This method creates
   // the RawInstruction and RawCode objects, sets up the pointer offsets
   // and links the two in a GC safe manner.
-  static RawCode* New(int pointer_offsets_length);
+  static RawCode* New(intptr_t pointer_offsets_length);
 
   HEAP_OBJECT_IMPLEMENTATION(Code, Object);
   friend class Class;
@@ -2507,6 +2547,9 @@
   }
   inline void SetAt(intptr_t context_index, const Instance& value) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Context);
+
   static intptr_t variable_offset(intptr_t context_index) {
     return OFFSET_OF(RawContext, data_[context_index]);
   }
@@ -2516,9 +2559,9 @@
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContext) +
-                                 (num_variables * kWordSize));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawContext) + (len * kBytesPerElement));
   }
 
   static RawContext* New(intptr_t num_variables,
@@ -2574,14 +2617,19 @@
   intptr_t ContextLevelAt(intptr_t scope_index) const;
   void SetContextLevelAt(intptr_t scope_index, intptr_t context_level) const;
 
+  static const intptr_t kBytesPerElement =
+      sizeof(RawContextScope::VariableDesc);
+  static const intptr_t kMaxElements = MAX_ELEMENTS(ContextScope);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawContextScope) == OFFSET_OF(RawContextScope, data_));
     return 0;
   }
 
-  static intptr_t InstanceSize(intptr_t num_variables) {
-    return RoundedAllocationSize(sizeof(RawContextScope) +
-        (num_variables * sizeof(RawContextScope::VariableDesc)));
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawContextScope) + (len * kBytesPerElement));
   }
 
   static RawContextScope* New(intptr_t num_variables);
@@ -3052,6 +3100,11 @@
 
 
 class Bigint : public Integer {
+ private:
+  typedef uint32_t Chunk;
+  typedef uint64_t DoubleChunk;
+  static const int kChunkSize = sizeof(Chunk);
+
  public:
   virtual bool IsZero() const { return raw_ptr()->signed_length_ == 0; }
   virtual bool IsNegative() const { return raw_ptr()->signed_length_ < 0; }
@@ -3063,20 +3116,20 @@
 
   virtual int CompareWith(const Integer& other) const;
 
-  static intptr_t InstanceSize(intptr_t length) {
-    ASSERT(length >= 0);
-    return RoundedAllocationSize(sizeof(RawBigint) + (length * sizeof(Chunk)));
-  }
+  static const intptr_t kBytesPerElement = kChunkSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Bigint);
+
   static intptr_t InstanceSize() { return 0; }
 
+  static intptr_t InstanceSize(intptr_t len) {
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawBigint) + (len * kBytesPerElement));
+  }
+
   static RawBigint* New(const String& str, Heap::Space space = Heap::kNew);
   static RawBigint* New(int64_t value, Heap::Space space = Heap::kNew);
 
  private:
-  typedef uint32_t Chunk;
-  typedef uint64_t DoubleChunk;
-  static const int kChunkSize = sizeof(Chunk);
-
   Chunk GetChunkAt(intptr_t i) const {
     return *ChunkAddr(i);
   }
@@ -3336,6 +3389,9 @@
 
   RawOneByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(OneByteString);
+
   static intptr_t data_offset() { return OFFSET_OF(RawOneByteString, data_); }
 
   static intptr_t InstanceSize() {
@@ -3344,7 +3400,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawOneByteString) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawOneByteString) + (len * kBytesPerElement));
   }
 
   static RawOneByteString* New(intptr_t len,
@@ -3397,13 +3455,18 @@
 
   RawTwoByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(TwoByteString);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawTwoByteString) == OFFSET_OF(RawTwoByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawTwoByteString) + (2 * len));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawTwoByteString) + (len * kBytesPerElement));
   }
 
   static RawTwoByteString* New(intptr_t len,
@@ -3452,13 +3515,18 @@
 
   RawFourByteString* EscapeDoubleQuotes() const;
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(FourByteString);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFourByteString) == OFFSET_OF(RawFourByteString, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawFourByteString) + (4 * len));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFourByteString) + (len * kBytesPerElement));
   }
 
   static RawFourByteString* New(intptr_t len,
@@ -3551,6 +3619,9 @@
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = (kIntptrMax / kBytesPerElement);
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalTwoByteString));
   }
@@ -3595,6 +3666,9 @@
     return raw_ptr()->external_data_->peer();
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = (kIntptrMax / kBytesPerElement);
+
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalFourByteString));
   }
@@ -3679,6 +3753,9 @@
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = kWordSize;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Array);
+
   static intptr_t type_arguments_offset() {
     return OFFSET_OF(RawArray, type_arguments_);
   }
@@ -3691,7 +3768,8 @@
   static intptr_t InstanceSize(intptr_t len) {
     // Ensure that variable length data is not adding to the object length.
     ASSERT(sizeof(RawArray) == (sizeof(RawObject) + (2 * kWordSize)));
-    return RoundedAllocationSize(sizeof(RawArray) + (len * kWordSize));
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(sizeof(RawArray) + (len * kBytesPerElement));
   }
 
   // Make the array immutable to Dart code by switching the class pointer
@@ -3726,9 +3804,6 @@
                        Heap::Space space = Heap::kNew);
 
  private:
-  // Make sure that the array size cannot wrap around.
-  static const intptr_t kMaxArrayElements = 512 * 1024 * 1024;
-
   RawObject** ObjectAddr(intptr_t index) const {
     // TODO(iposva): Determine if we should throw an exception here.
     ASSERT((index >= 0) && (index < Length()));
@@ -3930,6 +4005,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -3940,7 +4018,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawInt8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt8Array) + (len * kBytesPerElement));
   }
 
   static RawInt8Array* New(intptr_t len,
@@ -3977,6 +4057,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint8Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -3987,7 +4070,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawUint8Array) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint8Array) + (len * kBytesPerElement));
   }
 
   static RawUint8Array* New(intptr_t len,
@@ -4024,6 +4109,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4034,8 +4122,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt16Array) + (len * kBytesPerElement));
   }
 
   static RawInt16Array* New(intptr_t len,
@@ -4045,8 +4134,6 @@
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4074,6 +4161,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 2;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint16Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4084,8 +4174,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint16Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint16Array) + (len * kBytesPerElement));
   }
 
   static RawUint16Array* New(intptr_t len,
@@ -4095,8 +4186,6 @@
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 2;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4124,6 +4213,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4134,8 +4226,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt32Array) + (len * kBytesPerElement));
   }
 
   static RawInt32Array* New(intptr_t len,
@@ -4145,8 +4238,6 @@
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4174,6 +4265,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4184,8 +4278,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint32Array) + (len * kBytesPerElement));
   }
 
   static RawUint32Array* New(intptr_t len,
@@ -4195,8 +4290,6 @@
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4224,6 +4317,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Int64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4234,8 +4330,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawInt64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawInt64Array) + (len * kBytesPerElement));
   }
 
   static RawInt64Array* New(intptr_t len,
@@ -4245,8 +4342,6 @@
                             Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4274,6 +4369,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Uint64Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4284,8 +4382,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawUint64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawUint64Array) + (len * kBytesPerElement));
   }
 
   static RawUint64Array* New(intptr_t len,
@@ -4295,8 +4394,6 @@
                              Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4324,6 +4421,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 4;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float32Array);
+
   static intptr_t data_offset() {
     return length_offset() + kWordSize;
   }
@@ -4334,8 +4434,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat32Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat32Array) + (len * kBytesPerElement));
   }
 
   static RawFloat32Array* New(intptr_t len,
@@ -4345,8 +4446,6 @@
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 4;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -4374,6 +4473,9 @@
     raw_ptr()->data_[index] = value;
   }
 
+  static const intptr_t kBytesPerElement = 8;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(Float64Array);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawFloat64Array) == OFFSET_OF(RawFloat64Array, data_));
     return 0;
@@ -4384,8 +4486,9 @@
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    intptr_t data_size = len * kBytesPerElement;
-    return RoundedAllocationSize(sizeof(RawFloat64Array) + data_size);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawFloat64Array) + (len * kBytesPerElement));
   }
 
   static RawFloat64Array* New(intptr_t len,
@@ -4395,8 +4498,6 @@
                               Heap::Space space = Heap::kNew);
 
  private:
-  static const intptr_t kBytesPerElement = 8;
-
   uint8_t* ByteAddr(intptr_t byte_offset) const {
     ASSERT((byte_offset >= 0) && (byte_offset < ByteLength()));
     return reinterpret_cast<uint8_t*>(&raw_ptr()->data_) + byte_offset;
@@ -5030,13 +5131,18 @@
 
   virtual bool Equals(const Instance& other) const;
 
+  static const intptr_t kBytesPerElement = 1;
+  static const intptr_t kMaxElements = MAX_ELEMENTS(JSRegExp);
+
   static intptr_t InstanceSize() {
     ASSERT(sizeof(RawJSRegExp) == OFFSET_OF(RawJSRegExp, data_));
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t len) {
-    return RoundedAllocationSize(sizeof(RawJSRegExp) + len);
+    ASSERT(0 <= len && len <= kMaxElements);
+    return RoundedAllocationSize(
+        sizeof(RawJSRegExp) + (len * kBytesPerElement));
   }
 
   static RawJSRegExp* New(intptr_t length, Heap::Space space = Heap::kNew);