Fixes issue #28904 and issue #28901. Fixed an out of range array access in the hash map Iterator::N…

runtime/vm/hash_map.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef RUNTIME_VM_HASH_MAP_H_
 #define RUNTIME_VM_HASH_MAP_H_
 
 #include "vm/growable_array.h"  // For Malloc, EmptyBase
 #include "vm/zone.h"
 
@@ skipping 157 matching lines @@
 
 template <typename KeyValueTrait, typename B, typename Allocator>
 typename KeyValueTrait::Pair*
 BaseDirectChainedHashMap<KeyValueTrait, B, Allocator>::Iterator::Next() {
   const typename KeyValueTrait::Value kNoValue =
       KeyValueTrait::ValueOf(typename KeyValueTrait::Pair());
 
   if (array_index_ < map_.array_size_) {
     // If we're not in the middle of a list, find the next array slot.
     if (list_index_ == kNil) {
-      while (KeyValueTrait::ValueOf(map_.array_[array_index_].kv) == kNoValue &&
-             array_index_ < map_.array_size_) {
+      while (array_index_ < map_.array_size_ &&

[zra, 2017/03/03 18:03:54]

Please put parens around the < and == clauses.

+             KeyValueTrait::ValueOf(map_.array_[array_index_].kv) == kNoValue) {
         array_index_++;
       }
       if (array_index_ < map_.array_size_) {
         // When we're done with the list, we'll continue with the next array
         // slot.
         const intptr_t old_array_index = array_index_;
         array_index_++;
         list_index_ = map_.array_[old_array_index].next;
         return &map_.array_[old_array_index].kv;
       } else {
@@ skipping 247 matching lines @@
 
   static Key KeyOf(Pair kv) { return kv.key; }
   static Value ValueOf(Pair kv) { return kv.value; }
   static intptr_t Hashcode(Key key) { return reinterpret_cast<intptr_t>(key); }
   static bool IsKeyEqual(Pair kv, Key key) { return kv.key == key; }
 };
 
 }  // namespace dart
 
 #endif  // RUNTIME_VM_HASH_MAP_H_