Fix range checks for typed data in native code and the optimizer.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
 #include "vm/dart_entry.h"
 #include "vm/flow_graph_builder.h"
@@ skipping 2631 matching lines @@
   intptr_t element_size = FlowGraphCompiler::ElementSizeFor(receiver_cid);
   ConstantInstr* bytes_per_element =
       flow_graph()->GetConstant(Smi::Handle(Smi::New(element_size)));
   BinarySmiOpInstr* len_in_bytes =
       new BinarySmiOpInstr(Token::kMUL,
                            new Value(length),
                            new Value(bytes_per_element),
                            call->deopt_id());
   InsertBefore(call, len_in_bytes, call->env(), Definition::kValue);
 
-    // Check byte_index < len_in_bytes.
+  ConstantInstr* length_adjustment =
+      flow_graph()->GetConstant(Smi::Handle(Smi::New(
+          FlowGraphCompiler::ElementSizeFor(view_cid) - 1)));
+  // adjusted_length = len_in_bytes - (element_size - 1).
+  BinarySmiOpInstr* adjusted_length =
+      new BinarySmiOpInstr(Token::kSUB,
+                           new Value(len_in_bytes),
+                           new Value(length_adjustment),
+                           call->deopt_id());
+  InsertBefore(call, adjusted_length, call->env(), Definition::kValue);
+  // Check adjusted_length > 0.
+  ConstantInstr* zero = flow_graph()->GetConstant(Smi::Handle(Smi::New(0)));
   InsertBefore(call,
-               new CheckArrayBoundInstr(new Value(len_in_bytes),
+               new CheckArrayBoundInstr(new Value(adjusted_length),
+                                        new Value(zero),
+                                        call->deopt_id()),
+               call->env(),
+               Definition::kEffect);
+  // Check 0 <= byte_index < adjusted_length.
+  InsertBefore(call,
+               new CheckArrayBoundInstr(new Value(adjusted_length),
                                         new Value(byte_index),
                                         call->deopt_id()),
                call->env(),
                Definition::kEffect);
 
   // Insert load of elements for external typed arrays.
   if (RawObject::IsExternalTypedDataClassId(receiver_cid)) {
     LoadUntaggedInstr* elements =
         new LoadUntaggedInstr(new Value(*array),
                               ExternalTypedData::data_offset());
@@ skipping 5006 matching lines @@
   }
 
   // Insert materializations at environment uses.
   for (intptr_t i = 0; i < exits.length(); i++) {
     CreateMaterializationAt(exits[i], alloc, alloc->cls(), *fields);
   }
 }
 
 
 }  // namespace dart