Fix array-out-of-bounds in TypedDataView::ElementSizeInBytes.

runtime/vm/object.h

Index: runtime/vm/object.h
===================================================================
--- runtime/vm/object.h	(revision 43765)
+++ runtime/vm/object.h	(working copy)
@@ -6949,7 +6949,7 @@
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataClassId(class_id));
-    return element_size[ElementType(class_id)];
+    return element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
@@ -7030,7 +7030,14 @@
   }
 
  private:
-  static const intptr_t element_size[];
+  static intptr_t element_size(intptr_t index) {
+    ASSERT(0 <= index && index < kNumElementSizes);
+    intptr_t size = element_size_table[index]
+    ASSERT(size != 0);
+    return size;
+  }
+  static const intptr_t kNumElementSizes = 14;

[Ivan Posva, 2015/02/25 23:52:44]

Where does 14 come from?

[koda, 2015/02/25 23:57:59]

That's the number of elements in the array; see object.cc. Cannot use ARRAY_SIZE
here since the definition is not available, and we want this to be inlined. Do
you prefer I make a (redundant) enum instead?

[Ivan Posva, 2015/02/26 00:15:44]

Isn't it "(kTypedDataFloat64x2ArrayCid - kTypedDataInt8ArrayCid) + 1" or
something similar?

[koda, 2015/02/27 18:21:57]

Done.

Sure. Until we add another type :) In any case of size mismatch, either the
compiler will complain about too few entries, or the assert will fire on a zero
entry.

+  static const intptr_t element_size_table[kNumElementSizes];
 
   FINAL_HEAP_OBJECT_IMPLEMENTATION(TypedData, Instance);
   friend class Class;
@@ -7107,7 +7114,7 @@
 
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsExternalTypedDataClassId(class_id));
-    return TypedData::element_size[ElementType(class_id)];
+    return TypedData::element_size(ElementType(class_id));
   }
 
   static TypedDataElementType ElementType(intptr_t class_id) {
@@ -7200,8 +7207,7 @@
   static intptr_t ElementSizeInBytes(intptr_t class_id) {
     ASSERT(RawObject::IsTypedDataViewClassId(class_id));
     return (class_id == kByteDataViewCid) ?
-        TypedData::element_size[kTypedDataInt8ArrayCid] :
-        TypedData::element_size[class_id - kTypedDataInt8ArrayViewCid];
+        1 : TypedData::element_size(class_id - kTypedDataInt8ArrayViewCid);
   }
 
  private: