Fix for issue 4638 in bitmap builder.

runtime/vm/bitmap.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/bitmap.h"
 
 #include "platform/assert.h"
 #include "vm/object.h"
 
 namespace dart {
@@ skipping 14 matching lines @@
       if (byte_offset < data_size_in_bytes_) {
         memset(&data_[byte_offset], 0, data_size_in_bytes_ - byte_offset);
       }
     }
   }
   length_ = new_length;
 }
 
 
 bool BitmapBuilder::Get(intptr_t bit_offset) const {
-  ASSERT(InRange(bit_offset));
+  if (!InRange(bit_offset)) {
+    return false;
+  }
   intptr_t byte_offset = bit_offset >> kBitsPerByteLog2;
   // Bits not covered by the backing store are implicitly false.
   return (byte_offset < data_size_in_bytes_) && GetBit(bit_offset);
 }
 
 
 void BitmapBuilder::Set(intptr_t bit_offset, bool value) {
   ASSERT(bit_offset >= 0);
   if (!InRange(bit_offset)) {
     length_ = bit_offset + 1;
     // Bits not covered by the backing store are implicitly false.
     if (!value) return;
     // Grow the backing store if necessary.
     intptr_t byte_offset = bit_offset >> kBitsPerByteLog2;
+    if (byte_offset > kSmiMax) {
+      FATAL1("Fatal error in BitmapBuilder::Set : invalid bit_offset, %"Pd"\n",
+             bit_offset);
+    }
     if (byte_offset >= data_size_in_bytes_) {
       uint8_t* old_data = data_;
       intptr_t old_size = data_size_in_bytes_;
       data_size_in_bytes_ =
           Utils::RoundUp(byte_offset + 1, kIncrementSizeInBytes);
       ASSERT(data_size_in_bytes_ > 0);
       data_ = Isolate::Current()->current_zone()->Alloc<uint8_t>(
           data_size_in_bytes_);
       ASSERT(data_ != NULL);
       memmove(data_, old_data, old_size);
       memset(&data_[old_size], 0, (data_size_in_bytes_ - old_size));
     }
   }
   SetBit(bit_offset, value);
 }
 
 
 void BitmapBuilder::SetRange(intptr_t min, intptr_t max, bool value) {
   for (intptr_t i = min; i <= max; i++) {
     Set(i, value);
   }
 }
 
 
 bool BitmapBuilder::GetBit(intptr_t bit_offset) const {
-  ASSERT(InRange(bit_offset));
+  if (!InRange(bit_offset)) {
+    return false;
+  }
   intptr_t byte_offset = bit_offset >> kBitsPerByteLog2;
   ASSERT(byte_offset < data_size_in_bytes_);
   intptr_t bit_remainder = bit_offset & (kBitsPerByte - 1);
   uint8_t mask = 1U << bit_remainder;
   ASSERT(data_ != NULL);
   return ((data_[byte_offset] & mask) != 0);
 }
 
 
 void BitmapBuilder::SetBit(intptr_t bit_offset, bool value) {
-  ASSERT(InRange(bit_offset));
+  if (!InRange(bit_offset)) {
+    return;

[srdjan, 2013/06/05 15:57:21]

FATAL instead of return

[siva, 2013/06/05 16:22:09]

Done.

+  }
   int byte_offset = bit_offset >> kBitsPerByteLog2;
   ASSERT(byte_offset < data_size_in_bytes_);
   int bit_remainder = bit_offset & (kBitsPerByte - 1);
   uint8_t mask = 1U << bit_remainder;
   ASSERT(data_ != NULL);
   if (value) {
     data_[byte_offset] |= mask;
   } else {
     data_[byte_offset] &= ~mask;
   }
 }
 
 }  // namespace dart