Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/snapshot.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/snapshot.h"
 
 #include "platform/assert.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
 #include "vm/exceptions.h"
@@ skipping 127 matching lines @@
   ASSERT((value & kSmiTagMask) == 0);
   return reinterpret_cast<RawSmi*>(value);
 }
 
 
 intptr_t BaseReader::ReadSmiValue() {
   return  Smi::Value(ReadAsSmi());
 }
 
 
-SnapshotReader::SnapshotReader(const Snapshot* snapshot, Isolate* isolate)
-    : BaseReader(snapshot->content(), snapshot->length()),
-      kind_(snapshot->kind()),
+SnapshotReader::SnapshotReader(const uint8_t* buffer,
+                               intptr_t size,
+                               Snapshot::Kind kind,
+                               Isolate* isolate)
+    : BaseReader(buffer, size),
+      kind_(kind),
       isolate_(isolate),
       cls_(Class::Handle()),
       obj_(Object::Handle()),
       str_(String::Handle()),
       library_(Library::Handle()),
       type_(AbstractType::Handle()),
       type_arguments_(AbstractTypeArguments::Handle()),
       tokens_(Array::Handle()),
-      backward_references_((snapshot->kind() == Snapshot::kFull) ?
+      backward_references_((kind == Snapshot::kFull) ?
                            kNumInitialReferencesInFullSnapshot :
                            kNumInitialReferences) {
 }
 
 
 RawObject* SnapshotReader::ReadObject() {
   Object& obj = Object::Handle(ReadObjectImpl());
   for (intptr_t i = 0; i < backward_references_.length(); i++) {
     if (!backward_references_[i]->is_deserialized()) {
       ReadObjectImpl();
@@ skipping 680 matching lines @@
     }                                                                          \
 
     CLASS_LIST_NO_OBJECT(SNAPSHOT_WRITE)
 #undef SNAPSHOT_WRITE
     default: break;
   }
   UNREACHABLE();
 }
 
 
-void SnapshotWriter::WriteFullSnapshot() {
-  ASSERT(kind_ == Snapshot::kFull);
+void FullSnapshotWriter::WriteFullSnapshot() {
   Isolate* isolate = Isolate::Current();
   ASSERT(isolate != NULL);
   ObjectStore* object_store = isolate->object_store();
   ASSERT(object_store != NULL);
 
+  // Reserve space in the output buffer for a snapshot header.
+  ReserveHeader();
+
   // Write out all the objects in the object store of the isolate which
   // is the root set for all dart allocated objects at this point.
   SnapshotWriterVisitor visitor(this, false);
   object_store->VisitObjectPointers(&visitor);
 
   // Write out all forwarded objects.
   WriteForwardedObjects();
 
-  // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  FillHeader(kind());
+  UnmarkAll();
 }
 
 
 uword SnapshotWriter::GetObjectTags(RawObject* raw) {
   uword tags = raw->ptr()->tags_;
   if (SerializedHeaderTag::decode(tags) == kObjectId) {
     intptr_t id = SerializedHeaderData::decode(tags);
     return forward_list_[id - kMaxPredefinedObjectIds]->tags();
   } else {
     return tags;
@@ skipping 234 matching lines @@
   for (intptr_t i = 0; i < len; i++) {
     WriteObjectRef(data[i]);
   }
 }
 
 
 void ScriptSnapshotWriter::WriteScriptSnapshot(const Library& lib) {
   ASSERT(kind() == Snapshot::kScript);
 
   // Write out the library object.
+  ReserveHeader();
   WriteObject(lib.raw());
-
-  // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  FillHeader(kind());
+  UnmarkAll();
 }
 
 
 void SnapshotWriterVisitor::VisitPointers(RawObject** first, RawObject** last) {
   for (RawObject** current = first; current <= last; current++) {
     RawObject* raw_obj = *current;
     if (as_references_) {
       writer_->WriteObjectRef(raw_obj);
     } else {
       writer_->WriteObjectImpl(raw_obj);
     }
   }
 }
 
+
+void MessageWriter::WriteMessage(const Object& obj) {
+  ASSERT(kind() == Snapshot::kMessage);
+  WriteObject(obj.raw());
+  UnmarkAll();
+}
+
+
 }  // namespace dart