Fix array-out-of-bounds in TypedDataView::ElementSizeInBytes.

runtime/vm/object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_OBJECT_H_
 #define VM_OBJECT_H_
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "platform/utils.h"
@@ skipping 6931 matching lines @@
     return 0;
   }
 
   static intptr_t InstanceSize(intptr_t lengthInBytes) {
     ASSERT(0 <= lengthInBytes && lengthInBytes <= kSmiMax);
     return RoundedAllocationSize(sizeof(RawTypedData) + lengthInBytes);
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
-    return element_size[ElementType(class_id)];
+    return element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
     return static_cast<TypedDataElementType>(
         class_id - kTypedDataInt8ArrayCid);
   }
 
   static intptr_t MaxElements(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
@@ skipping 60 matching lines @@
   }
 
   static RawTypedData* EmptyUint32Array(Isolate* isolate);
 
  protected:
   void SetLength(intptr_t value) const {
     StoreSmi(&raw_ptr()->length_, Smi::New(value));
   }
 
  private:
-  static const intptr_t element_size[];
+  static intptr_t element_size(intptr_t index) {
+    ASSERT(0 <= index && index < kNumElementSizes);
+    intptr_t size = element_size_table[index];
+    ASSERT(size != 0);
+    return size;
+  }
+  static const intptr_t kNumElementSizes =
+      kTypedDataFloat64x2ArrayCid - kTypedDataInt8ArrayCid + 1;
+  static const intptr_t element_size_table[kNumElementSizes];
 
   FINAL_HEAP_OBJECT_IMPLEMENTATION(TypedData, Instance);
   friend class Class;
   friend class ExternalTypedData;
   friend class TypedDataView;
 };
 
 
 class ExternalTypedData : public Instance {
  public:
@@ skipping 56 matching lines @@
   static intptr_t data_offset() {
     return OFFSET_OF(RawExternalTypedData, data_);
   }
 
   static intptr_t InstanceSize() {
     return RoundedAllocationSize(sizeof(RawExternalTypedData));
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
-    return TypedData::element_size[ElementType(class_id)];
+    return TypedData::element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
     return static_cast<TypedDataElementType>(
         class_id - kExternalTypedDataInt8ArrayCid);
   }
 
   static intptr_t MaxElements(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
@@ skipping 72 matching lines @@
     return kWordSize * kOffsetInBytesOffset;
   }
 
   static intptr_t length_offset() {
     return kWordSize * kLengthOffset;
   }
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataViewClassId(class_id));
     return (class_id == kByteDataViewCid) ?
-        TypedData::element_size[kTypedDataInt8ArrayCid] :
-        TypedData::element_size[class_id - kTypedDataInt8ArrayViewCid];
+        1 : TypedData::element_size(class_id - kTypedDataInt8ArrayViewCid);
   }
 
  private:
   enum {
     kDataOffset = 1,
     kOffsetInBytesOffset = 2,
     kLengthOffset = 3,
   };
 };
 
@@ skipping 591 matching lines @@
 
 
 RawObject* MegamorphicCache::GetTargetFunction(const Array& array,
                                                intptr_t index) {
   return array.At((index * kEntryLength) + kTargetFunctionIndex);
 }
 
 }  // namespace dart
 
 #endif  // VM_OBJECT_H_