VM: Fix DBC out-of-bounds load from Uint32List.

runtime/vm/simulator_dbc.cc

Index: runtime/vm/simulator_dbc.cc
diff --git a/runtime/vm/simulator_dbc.cc b/runtime/vm/simulator_dbc.cc
index 8febf13468918bb2fb8946a1becdc1b78815e38e..cf3ebff1ee92402d1009d065f96a911a5b94650b 100644
--- a/runtime/vm/simulator_dbc.cc
+++ b/runtime/vm/simulator_dbc.cc
@@ -3499,14 +3499,16 @@ RawObject* Simulator::Call(const Code& code,
   {
     BYTECODE(LoadIndexedUint32, A_B_C);
     uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
-    FP[rA] = reinterpret_cast<RawObject*>(*reinterpret_cast<uintptr_t*>(data));
+    uint32_t value = *reinterpret_cast<uint32_t*>(data);

[zra, 2016/12/02 05:07:53]

cosnt

[Florian Schneider, 2016/12/02 18:35:01]

Can haz const.

+    FP[rA] = reinterpret_cast<RawObject*>(value);
     DISPATCH();
   }
 
   {
     BYTECODE(LoadIndexedInt32, A_B_C);
     uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
-    FP[rA] = reinterpret_cast<RawObject*>(*reinterpret_cast<intptr_t*>(data));
+    int32_t value = *reinterpret_cast<int32_t*>(data);

[zra, 2016/12/02 05:07:52]

const

[Florian Schneider, 2016/12/02 18:35:01]

Ditto.

+    FP[rA] = reinterpret_cast<RawObject*>(value);
     DISPATCH();
   }