Fix crash in Bigint::New(....), read only digits field was being modified resulting in a crash.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 17611 matching lines @@
                                       Bigint::InstanceSize(),
                                       space);
     NoSafepointScope no_safepoint;
     result ^= raw;
   }
   // Clamp the digits array.
   while ((used > 0) && (digits.GetUint32((used - 1) << 2) == 0)) {
     --used;
   }
   if (used > 0) {
-    if ((used & 1) != 0) {
-      // Set leading zero for 64-bit processing of digit pairs.
+    if (((used & 1) != 0) && (digits.GetUint32(used << 2) != 0)) {
+      // Set leading zero for 64-bit processing of digit pairs if not set.

[regis, 2016/02/11 23:38:11]

I would add a comment explaining that we avoid a write access to a possibly
re-used digit array that could be marked read-only.

[siva, 2016/02/11 23:57:24]

Done.

       digits.SetUint32(used << 2, 0);
     }
     result.set_digits(digits);
   } else {
     neg = false;
     result.set_digits(
         TypedData::Handle(zone, TypedData::EmptyUint32Array(thread)));
   }
   result.SetNeg(neg);
   result.SetUsed(used);
@@ skipping 3762 matching lines @@
   return UserTag::null();
 }
 
 
 const char* UserTag::ToCString() const {
   const String& tag_label = String::Handle(label());
   return tag_label.ToCString();
 }
 
 }  // namespace dart