Avoid trusting the length encoded in the Snapshot if there is an

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
===================================================================
--- runtime/vm/snapshot.cc	(revision 10993)
+++ runtime/vm/snapshot.cc	(working copy)
@@ -136,9 +136,12 @@
 }
 
 
-SnapshotReader::SnapshotReader(const Snapshot* snapshot, Isolate* isolate)
-    : BaseReader(snapshot->content(), snapshot->length()),
-      kind_(snapshot->kind()),
+SnapshotReader::SnapshotReader(const uint8_t* buffer,
+                               intptr_t size,
+                               Snapshot::Kind kind,
+                               Isolate* isolate)
+    : BaseReader(buffer, size),
+      kind_(kind),
       isolate_(isolate),
       cls_(Class::Handle()),
       obj_(Object::Handle()),
@@ -147,7 +150,7 @@
       type_(AbstractType::Handle()),
       type_arguments_(AbstractTypeArguments::Handle()),
       tokens_(Array::Handle()),
-      backward_references_((snapshot->kind() == Snapshot::kFull) ?
+      backward_references_((kind == Snapshot::kFull) ?
                            kNumInitialReferencesInFullSnapshot :
                            kNumInitialReferences) {
 }
@@ -837,13 +840,15 @@
 }
 
 
-void SnapshotWriter::WriteFullSnapshot() {
-  ASSERT(kind_ == Snapshot::kFull);
+void FullSnapshotWriter::WriteFullSnapshot() {
   Isolate* isolate = Isolate::Current();
   ASSERT(isolate != NULL);
   ObjectStore* object_store = isolate->object_store();
   ASSERT(object_store != NULL);
 
+  // Reserve space in the output buffer for a snapshot header.
+  ReserveHeader();
+
   // Write out all the objects in the object store of the isolate which
   // is the root set for all dart allocated objects at this point.
   SnapshotWriterVisitor visitor(this, false);
@@ -852,8 +857,8 @@
   // Write out all forwarded objects.
   WriteForwardedObjects();
 
-  // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  FillHeader(kind());
+  UnmarkAll();
 }
 
 
@@ -1108,10 +1113,10 @@
   ASSERT(kind() == Snapshot::kScript);
 
   // Write out the library object.
+  ReserveHeader();
   WriteObject(lib.raw());
-
-  // Finalize the snapshot buffer.
-  FinalizeBuffer();
+  FillHeader(kind());
+  UnmarkAll();
 }
 
 
@@ -1126,4 +1131,12 @@
   }
 }
 
+
+void MessageWriter::WriteMessage(const Object& obj) {
+  ASSERT(kind() == Snapshot::kMessage);
+  WriteObject(obj.raw());
+  UnmarkAll();
+}
+
+
 }  // namespace dart