- Do not read past the end of the utf32_array.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
@@ skipping 9978 matching lines @@
       return false;
     }
   }
   return true;
 }
 
 
 bool String::Equals(const int32_t* utf32_array, intptr_t len) const {
   CodePointIterator it(*this);
   intptr_t i = 0;
-  while (it.Next()) {
-    if (it.Current() != static_cast<int32_t>(utf32_array[i])) {
+  bool has_more = it.Next();
+  while (has_more && (i < len)) {
+    if ((it.Current() != static_cast<int32_t>(utf32_array[i]))) {
       return false;
     }
+    // Advance both streams forward.
     ++i;
+    has_more = it.Next();
   }
-  if (i != len) {
-    return false;
-  }
-  return true;
+  // Strings are only true iff we reached the end in both streams.
+  return (i == len) && !has_more;
 }
 
 
 intptr_t String::CompareTo(const String& other) const {
   const intptr_t this_len = this->Length();
   const intptr_t other_len = other.IsNull() ? 0 : other.Length();
   const intptr_t len = (this_len < other_len) ? this_len : other_len;
   for (intptr_t i = 0; i < len; i++) {
     int32_t this_code_point = this->CharAt(i);
     int32_t other_code_point = other.CharAt(i);
@@ skipping 2100 matching lines @@
   }
   return result.raw();
 }
 
 
 const char* WeakProperty::ToCString() const {
   return "_WeakProperty";
 }
 
 }  // namespace dart