Fix range checks for typed data in native code and the optimizer.

runtime/vm/flow_graph_optimizer.cc

Index: runtime/vm/flow_graph_optimizer.cc
===================================================================
--- runtime/vm/flow_graph_optimizer.cc	(revision 27650)
+++ runtime/vm/flow_graph_optimizer.cc	(working copy)
@@ -2649,10 +2649,19 @@
                            call->deopt_id());
   InsertBefore(call, len_in_bytes, call->env(), Definition::kValue);
 
-    // Check byte_index < len_in_bytes.
+  // Check byte_index + num_bytes < len_in_bytes.

[Ivan Posva, 2013/09/20 17:20:30]

Where is the check that byte_index is positive?

[siva, 2013/09/20 22:03:45]

We have been using the name 'element_size_in_bytes' for this consistently, could
we call this 'element_size_in_bytes' instead of 'num_bytes'

[Florian Schneider, 2013/09/23 11:02:26]

Changed to access_size.

[Florian Schneider, 2013/09/23 11:02:26]

Good catch. Changed into two checks using CheckArrayBoundInstr and added a test:

0 <= element_size - 1 < length

and

0 <= byte_index < length - (element_size - 1)

+  ConstantInstr* num_bytes =
+      flow_graph()->GetConstant(Smi::Handle(Smi::New(
+          FlowGraphCompiler::ElementSizeFor(view_cid) - 1)));
+  BinarySmiOpInstr* adjusted_index =
+      new BinarySmiOpInstr(Token::kADD,
+                           new Value(byte_index),
+                           new Value(num_bytes),
+                           call->deopt_id());
+  InsertBefore(call, adjusted_index, call->env(), Definition::kValue);
   InsertBefore(call,
                new CheckArrayBoundInstr(new Value(len_in_bytes),
-                                        new Value(byte_index),
+                                        new Value(adjusted_index),
                                         call->deopt_id()),
                call->env(),
                Definition::kEffect);