Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/intrinsifier_arm64.cc

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM64.
 #if defined(TARGET_ARCH_ARM64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 202 matching lines @@
   __ LslImmediate(R2, R2, scale_shift);                                        \
   const intptr_t fixed_size = sizeof(Raw##type_name) + kObjectAlignment - 1;   \
   __ AddImmediate(R2, R2, fixed_size, kNoPP);                                  \
   __ andi(R2, R2, Immediate(~(kObjectAlignment - 1)));                         \
   Heap* heap = Isolate::Current()->heap();                                     \
   Heap::Space space = heap->SpaceForAllocation(cid);                           \
   __ LoadImmediate(R0, heap->TopAddress(space), kNoPP);                        \
   __ ldr(R0, Address(R0, 0));                                                  \
                                                                                \
   /* R2: allocation size. */                                                   \
   __ add(R1, R0, Operand(R2));                                                 \

[zra, 2015/04/21 14:55:27]

adds

[koda, 2015/04/21 16:08:46]

Done.

-  __ b(&fall_through, VS);                                                     \
+  __ b(&fall_through, CS);  /* Fail on unsigned overflow. */                   \
                                                                                \
   /* Check if the allocation fits into the remaining space. */                 \
   /* R0: potential new object start. */                                        \
   /* R1: potential next object start. */                                       \
   /* R2: allocation size. */                                                   \
   __ LoadImmediate(R3, heap->EndAddress(space), kNoPP);                        \
   __ ldr(R3, Address(R3, 0));                                                  \
   __ cmp(R1, Operand(R3));                                                     \
   __ b(&fall_through, CS);                                                     \
                                                                                \
@@ skipping 1488 matching lines @@
 // initialized.
 // 'length-reg' (R2) contains tagged length.
 // Returns new string as tagged pointer in R0.
 static void TryAllocateOnebyteString(Assembler* assembler,
                                      Label* ok,
                                      Label* failure) {
   const Register length_reg = R2;
   Label fail;
 
   __ mov(R6, length_reg);  // Save the length register.
+  // TODO(koda): Protect against negative length and overflow here.
   __ SmiUntag(length_reg);
   const intptr_t fixed_size = sizeof(RawString) + kObjectAlignment - 1;
   __ AddImmediate(length_reg, length_reg, fixed_size, kNoPP);
   __ andi(length_reg, length_reg, Immediate(~(kObjectAlignment - 1)));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
   const intptr_t cid = kOneByteStringCid;
   Heap::Space space = heap->SpaceForAllocation(cid);
   __ LoadImmediate(R3, heap->TopAddress(space), kNoPP);
   __ ldr(R0, Address(R3));
 
   // length_reg: allocation size.
   __ adds(R1, R0, Operand(length_reg));
-  __ b(&fail, VS);  // Fail on overflow.
+  __ b(&fail, CS);  // Fail on unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // R0: potential new object start.
   // R1: potential next object start.
   // R2: allocation size.
   // R3: heap->TopAddress(space).
   __ LoadImmediate(R7, heap->EndAddress(space), kNoPP);
   __ ldr(R7, Address(R7));
   __ cmp(R1, Operand(R7));
   __ b(&fail, CS);
@@ skipping 262 matching lines @@
   Isolate* isolate = Isolate::Current();
   __ LoadImmediate(R1, reinterpret_cast<uword>(isolate), kNoPP);
   // Set return value to Isolate::current_tag_.
   __ ldr(R0, Address(R1, Isolate::current_tag_offset()));
   __ ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM64