Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/intrinsifier_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM.
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 192 matching lines @@
   __ mov(R2, Operand(R2, LSL, scale_shift));                                   \
   const intptr_t fixed_size = sizeof(Raw##type_name) + kObjectAlignment - 1;   \
   __ AddImmediate(R2, fixed_size);                                             \
   __ bic(R2, R2, Operand(kObjectAlignment - 1));                               \
   Heap* heap = Isolate::Current()->heap();                                     \
   Heap::Space space = heap->SpaceForAllocation(cid);                           \
   __ LoadImmediate(R0, heap->TopAddress(space));                               \
   __ ldr(R0, Address(R0, 0));                                                  \
                                                                                \
   /* R2: allocation size. */                                                   \
   __ add(R1, R0, Operand(R2));                                                 \

[zra, 2015/04/21 14:55:27]

adds

[koda, 2015/04/21 16:08:46]

Done.

-  __ b(&fall_through, VS);                                                     \
+  __ b(&fall_through, CS);  /* Fail on unsigned overflow. */                   \
                                                                                \
   /* Check if the allocation fits into the remaining space. */                 \
   /* R0: potential new object start. */                                        \
   /* R1: potential next object start. */                                       \
   /* R2: allocation size. */                                                   \
   __ LoadImmediate(R3, heap->EndAddress(space));                               \
   __ ldr(R3, Address(R3, 0));                                                  \
   __ cmp(R1, Operand(R3));                                                     \
   __ b(&fall_through, CS);                                                     \
                                                                                \
@@ skipping 1421 matching lines @@
 // initialized.
 // 'length-reg' (R2) contains tagged length.
 // Returns new string as tagged pointer in R0.
 static void TryAllocateOnebyteString(Assembler* assembler,
                                      Label* ok,
                                      Label* failure) {
   const Register length_reg = R2;
   Label fail;
 
   __ mov(R6, Operand(length_reg));  // Save the length register.
+  // TODO(koda): Protect against negative length and overflow here.
   __ SmiUntag(length_reg);
   const intptr_t fixed_size = sizeof(RawString) + kObjectAlignment - 1;
   __ AddImmediate(length_reg, fixed_size);
   __ bic(length_reg, length_reg, Operand(kObjectAlignment - 1));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
   const intptr_t cid = kOneByteStringCid;
   Heap::Space space = heap->SpaceForAllocation(cid);
   __ LoadImmediate(R3, heap->TopAddress(space));
   __ ldr(R0, Address(R3, 0));
 
   // length_reg: allocation size.
   __ adds(R1, R0, Operand(length_reg));
-  __ b(&fail, VS);  // Fail on overflow.
+  __ b(&fail, CS);  // Fail on unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // R0: potential new object start.
   // R1: potential next object start.
   // R2: allocation size.
   // R3: heap->TopAddress(space).
   __ LoadImmediate(R7, heap->EndAddress(space));
   __ ldr(R7, Address(R7, 0));
   __ cmp(R1, Operand(R7));
   __ b(&fail, CS);
@@ skipping 265 matching lines @@
   Isolate* isolate = Isolate::Current();
   __ LoadImmediate(R1, reinterpret_cast<uword>(isolate));
   // Set return value to Isolate::current_tag_.
   __ ldr(R0, Address(R1, Isolate::current_tag_offset()));
   __ Ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM