Fix crash when posting a message to a send port with port id 0.

runtime/vm/port.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/port.h"
 
 #include "platform/utils.h"
 #include "vm/dart_api_impl.h"
 #include "vm/isolate.h"
 #include "vm/lockers.h"
 #include "vm/message_handler.h"
 #include "vm/os_thread.h"
 
 namespace dart {
 
 DECLARE_FLAG(bool, trace_isolates);
 
 Mutex* PortMap::mutex_ = NULL;
 PortMap::Entry* PortMap::map_ = NULL;
 MessageHandler* PortMap::deleted_entry_ = reinterpret_cast<MessageHandler*>(1);
 intptr_t PortMap::capacity_ = 0;
 intptr_t PortMap::used_ = 0;
 intptr_t PortMap::deleted_ = 0;
 Random* PortMap::prng_ = NULL;
 
 
 intptr_t PortMap::FindPort(Dart_Port port) {
+  // ILLEGAL_PORT (0) is used as a sentinel value in Entry.port. The loop below
+  // could return the index to a deleted port when we are searching for
+  // port id ILLEGAL_PORT. Return -1 immediately to indicate the port
+  // does not exist.
+  if (port == ILLEGAL_PORT) {
+    return -1;
+  }
+  ASSERT(port != ILLEGAL_PORT);
   intptr_t index = port % capacity_;
   intptr_t start_index = index;
   Entry entry = map_[index];
   while (entry.handler != NULL) {
     if (entry.port == port) {
       return index;
     }
     index = (index + 1) % capacity_;
     // Prevent endless loops.
     ASSERT(index != start_index);
@@ skipping 249 matching lines @@
   // TODO(iposva): Verify whether we want to keep exponentially growing.
   ASSERT(Utils::IsPowerOfTwo(kInitialCapacity));
   map_ = new Entry[kInitialCapacity];
   memset(map_, 0, kInitialCapacity * sizeof(Entry));
   capacity_ = kInitialCapacity;
   used_ = 0;
   deleted_ = 0;
 }
 
 }  // namespace dart