VM: Fix checked mode crash (issue 13831).

runtime/vm/class_finalizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/class_finalizer.h"
 
 #include "vm/flags.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/longjump.h"
@@ skipping 1200 matching lines @@
                             RawFunction::kImplicitStaticFinalGetter,
                             /* is_static = */ true,
                             /* is_const = */ field.is_const(),
                             /* is_abstract = */ false,
                             /* is_external = */ false,
                             cls,
                             field.token_pos()));
           getter.set_result_type(type);
           cls.AddFunction(getter);
           field.set_value(Instance::Handle(Object::sentinel().raw()));
+
+          // Create initializer function.
+          // We don't have the start position of the initializer expression
+          // here, but can compute it from the field identifier position:
+          // The initializer expression starts after the assignment token at +2.
+          const intptr_t initializer_pos = field.token_pos() + 2;

[hausner, 2013/10/31 21:53:47]

The + 2 is incorrect. The token position is a byte offset into an array of
variable length objects. You are increasing by two bytes, not two tokens. The
field identifier token you skipping is not one byte long, so you are most likely
pointing into the middle of a token value with this calculated offset.

[Florian Schneider, 2013/11/01 10:23:42]

Oops, yes that will go wrong. I'll fix it. I think the cleanest way would be to
just not do the eager optimization with static getters in the parser that has to
be undone here. I'll check what the performance impact of this would be.

+          const Function& init_function = Function::ZoneHandle(
+              Function::NewStaticInitializer(
+                  String::Handle(field.name()),
+                  type,
+                  cls,
+                  initializer_pos));
+          cls.AddFunction(init_function);
         }
       }
     }
   }
   // Collect interfaces, super interfaces, and super classes of this class.
   const GrowableObjectArray& interfaces =
       GrowableObjectArray::Handle(GrowableObjectArray::New());
   CollectInterfaces(cls, interfaces);
   // Include superclasses in list of interfaces and super interfaces.
   super_class = cls.SuperClass();
@@ skipping 1520 matching lines @@
   expected_name ^= String::New("_offset");
   ASSERT(String::EqualsIgnoringPrivateKey(name, expected_name));
   field ^= fields_array.At(2);
   ASSERT(field.Offset() == TypedDataView::length_offset());
   name ^= field.name();
   ASSERT(name.Equals("length"));
 #endif
 }
 
 }  // namespace dart