Fix OOB write in --print-code.

src/utils.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 28 matching lines @@
   position_ = 0;
 }
 
 
 void SimpleStringBuilder::AddString(const char* s) {
   AddSubstring(s, StrLength(s));
 }
 
 
 void SimpleStringBuilder::AddSubstring(const char* s, int n) {
-  ASSERT(!is_finalized() && position_ + n < buffer_.length());
+  ASSERT(!is_finalized() && position_ + n <= buffer_.length());
   ASSERT(static_cast<size_t>(n) <= strlen(s));
   memcpy(&buffer_[position_], s, n * kCharSize);
   position_ += n;
 }
 
 
 void SimpleStringBuilder::AddPadding(char c, int count) {
   for (int i = 0; i < count; i++) {
     AddCharacter(c);
   }
@@ skipping 12 matching lines @@
   }
   position_ += digits;
   for (int i = 1; i <= digits; i++) {
     buffer_[position_ - i] = '0' + static_cast<char>(number % 10);
     number /= 10;
   }
 }
 
 
 char* SimpleStringBuilder::Finalize() {
-  ASSERT(!is_finalized() && position_ < buffer_.length());
+  ASSERT(!is_finalized() && position_ <= buffer_.length());
+  // If there is no space for null termination, overwrite last character.
+  if (position_ == buffer_.length()) {
+    position_--;
+    // Print ellipsis.
+    for (int i = 3; i > 0 && position_ > i; --i) buffer_[position_ - i] = '.';
+  }
   buffer_[position_] = '\0';
   // Make sure nobody managed to add a 0-character to the
   // buffer while building the string.
   ASSERT(strlen(buffer_.start()) == static_cast<size_t>(position_));
   position_ = -1;
   ASSERT(is_finalized());
   return buffer_.start();
 }
 
 
 const DivMagicNumbers DivMagicNumberFor(int32_t divisor) {
   switch (divisor) {
     case 3:    return DivMagicNumberFor3;
     case 5:    return DivMagicNumberFor5;
     case 7:    return DivMagicNumberFor7;
     case 9:    return DivMagicNumberFor9;
     case 11:   return DivMagicNumberFor11;
     case 25:   return DivMagicNumberFor25;
     case 125:  return DivMagicNumberFor125;
     case 625:  return DivMagicNumberFor625;
     default:   return InvalidDivMagicNumber;
   }
 }
 
 } }  // namespace v8::internal