Canvas.concat takes a 16-element Float32List instead of an array.

sky/engine/core/painting/Float32List.cpp

Index: sky/engine/core/painting/Float32List.cpp
diff --git a/sky/engine/core/painting/Float32List.cpp b/sky/engine/core/painting/Float32List.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..d575e9c8c56dde7bed58977fa3fcb9618742e78e
--- /dev/null
+++ b/sky/engine/core/painting/Float32List.cpp
@@ -0,0 +1,46 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sky/engine/config.h"
+#include "sky/engine/core/painting/Float32List.h"
+
+#include "sky/engine/core/script/dom_dart_state.h"
+#include "sky/engine/tonic/dart_error.h"
+#include "base/logging.h"
+
+namespace blink {
+
+void Float32List::Init(Dart_Handle list) {

[abarth-chromium, 2015/06/04 16:58:16]

Is there some reason this isn't a constructor?

[Matt Perry, 2015/06/04 17:22:44]

Not a good one.

+  dart_handle_ = list;
+  data = nullptr;
+  num_elements = 0;
+
+  if (Dart_IsNull(list))
+    return;
+
+  Dart_TypedData_Type type;
+  Dart_TypedDataAcquireData(
+      list, &type, reinterpret_cast<void**>(&data), &num_elements);
+  DCHECK(!LogIfError(list));
+  ASSERT(type == Dart_TypedData_kFloat32);
+}
+
+Float32List::~Float32List() {
+  Dart_TypedDataReleaseData(dart_handle_);
+}
+
+Float32List DartConverter<Float32List>::FromArgumentsWithNullCheck(
+    Dart_NativeArguments args,
+    int index,
+    Dart_Handle& exception) {
+  Float32List result;
+
+  Dart_Handle list = Dart_GetNativeArgument(args, index);
+  DCHECK(!LogIfError(list));
+  result.Init(list);
+
+  return result;

[abarth-chromium, 2015/06/04 16:58:16]

When ~Float32List runs, it will call Dart_TypedDataReleaseData, which will make
|data| invalid.  Here's you're returning |result| by value, which (in principle)
runs ~Float32List.

You're actually saved here by NRVO, but this is very fragile...

I'd recommend making Float32List a move-only type by removing the copy
constructor and instead relying on the move constructor.

[Matt Perry, 2015/06/04 17:22:44]

Good point. Done.

+}
+
+} // namespace blink