Fix array-out-of-bounds in TypedDataView::ElementSizeInBytes.

runtime/vm/object.h

Index: runtime/vm/object.h
===================================================================
--- runtime/vm/object.h	(revision 43765)
+++ runtime/vm/object.h	(working copy)
@@ -6949,7 +6949,7 @@
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
-    return element_size[ElementType(class_id)];
+    return element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
@@ -7030,7 +7030,15 @@
   }
 
  private:
-  static const intptr_t element_size[];
+  static intptr_t element_size(intptr_t index) {
+    ASSERT(0 <= index && index < kNumElementSizes);
+    intptr_t size = element_size_table[index];
+    ASSERT(size != 0);
+    return size;
+  }
+  static const intptr_t kNumElementSizes =
+      kTypedDataFloat64x2ArrayCid - kTypedDataInt8ArrayCid + 1;
+  static const intptr_t element_size_table[kNumElementSizes];
 
   FINAL_HEAP_OBJECT_IMPLEMENTATION(TypedData, Instance);
   friend class Class;
@@ -7107,7 +7115,7 @@
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
-    return TypedData::element_size[ElementType(class_id)];
+    return TypedData::element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
@@ -7200,8 +7208,7 @@
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataViewClassId(class_id));
     return (class_id == kByteDataViewCid) ?
-        TypedData::element_size[kTypedDataInt8ArrayCid] :
-        TypedData::element_size[class_id - kTypedDataInt8ArrayViewCid];
+        1 : TypedData::element_size(class_id - kTypedDataInt8ArrayViewCid);
   }
 
  private: