VM: Fix DBC out-of-bounds load from Uint32List.

runtime/vm/simulator_dbc.cc

Index: runtime/vm/simulator_dbc.cc
diff --git a/runtime/vm/simulator_dbc.cc b/runtime/vm/simulator_dbc.cc
index 8febf13468918bb2fb8946a1becdc1b78815e38e..8ff437a60b2a10c242e79906444104c4581f551c 100644
--- a/runtime/vm/simulator_dbc.cc
+++ b/runtime/vm/simulator_dbc.cc
@@ -3498,15 +3498,17 @@ RawObject* Simulator::Call(const Code& code,
 
   {
     BYTECODE(LoadIndexedUint32, A_B_C);
-    uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
-    FP[rA] = reinterpret_cast<RawObject*>(*reinterpret_cast<uintptr_t*>(data));
+    const uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
+    const uint32_t value = *reinterpret_cast<const uint32_t*>(data);
+    FP[rA] = reinterpret_cast<RawObject*>(value);
     DISPATCH();
   }
 
   {
     BYTECODE(LoadIndexedInt32, A_B_C);
-    uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
-    FP[rA] = reinterpret_cast<RawObject*>(*reinterpret_cast<intptr_t*>(data));
+    const uint8_t* data = SimulatorHelpers::GetTypedData(FP[rB], FP[rC]);
+    const int32_t value = *reinterpret_cast<const int32_t*>(data);
+    FP[rA] = reinterpret_cast<RawObject*>(value);
     DISPATCH();
   }