Treat negative utf8-units the same way as other broken encodings.

sdk/lib/convert/utf.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.convert;
 
 /**
  * An instance of the default implementation of the [Utf8Codec].
  *
  * This instance provides a convenient access to the most common UTF-8
@@ skipping 437 matching lines @@
           value = _REPLACEMENT_CHARACTER;
         }
         if (!_isFirstCharacter || value != _BOM_CHARACTER) {
           _stringSink.writeCharCode(value);
         }
         _isFirstCharacter = false;
       }
 
       while (i < endIndex) {
         int unit = codeUnits[i++];
-        if (unit <= _ONE_BYTE_LIMIT) {
+        if (unit < 0) {

[Lasse Reichstein Nielsen, 2013/08/22 06:10:42]

Would it be cheaper/faster to do:
  if ((unit & ~0x7f) == 0) {
    // one-byte
  } else if ((unit & ~0xdf) == 0) {
    // two-byte
  } else if ((unit & ~0xef) == 0) {
    // three-byte
  } else if ((unit & ~0xf7) == 0) {
    // four-byte
  } else {
    // malformed
  }

This puts the most common case first, instead of wasting time checking for
malformedness first. Each check should be a single bit-and + branch-if-not-zero
in optimized smi code, so it's hard to make cheaper. Negative numbers are tested
the same way as any other numbers - they have bits set outside the first octet.

[floitsch, 2013/08/22 15:40:25]

Rapidly tried it, but somehow introduced a bug. Now added a TODO.

+          // TODO(floitsch): should this be unit <= 0 ?

[Lasse Reichstein Nielsen, 2013/08/22 06:10:42]

No, zero is a valid UTF-8 code unit encoding the U+0000 code point.

[floitsch, 2013/08/22 15:40:25]

Done.

+          if (!_allowMalformed) {
+            throw new FormatException(
+                "Negative UTF-8 code unit: -0x${(-unit).toRadixString(16)}");
+          }
+          _stringSink.writeCharCode(_REPLACEMENT_CHARACTER);
+        } else if (unit <= _ONE_BYTE_LIMIT) {
           _isFirstCharacter = false;
           _stringSink.writeCharCode(unit);
         } else {
           if ((unit & 0xE0) == 0xC0) {
             value = unit & 0x1F;
             expectedUnits = extraUnits = 1;
             continue loop;
           }
           if ((unit & 0xF0) == 0xE0) {
             value = unit & 0x0F;
@@ skipping 18 matching lines @@
       }
       break loop;
     }
     if (expectedUnits > 0) {
       _value = value;
       _expectedUnits = expectedUnits;
       _extraUnits = extraUnits;
     }
   }
 }