Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/intrinsifier_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_MIPS.
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 182 matching lines @@
   const intptr_t fixed_size = sizeof(Raw##type_name) + kObjectAlignment - 1;   \
   __ AddImmediate(T2, fixed_size);                                             \
   __ LoadImmediate(TMP, -kObjectAlignment);                                    \
   __ and_(T2, T2, TMP);                                                        \
   Heap* heap = Isolate::Current()->heap();                                     \
   Heap::Space space = heap->SpaceForAllocation(cid);                           \
   __ LoadImmediate(V0, heap->TopAddress(space));                               \
   __ lw(V0, Address(V0, 0));                                                   \
                                                                                \
   /* T2: allocation size. */                                                   \
-  __ AdduDetectOverflow(T1, V0, T2, CMPRES1);                                  \
-  __ bltz(CMPRES1, &fall_through);                                             \
+  __ addu(T1, V0, T2);                                                         \
+  /* Branch on unsigned overflow. */                                           \
+  __ BranchUnsignedLess(T1, V0, &fall_through);                                \
                                                                                \
   /* Check if the allocation fits into the remaining space. */                 \
   /* V0: potential new object start. */                                        \
   /* T1: potential next object start. */                                       \
   /* T2: allocation size. */                                                   \
   __ LoadImmediate(T3, heap->EndAddress(space));                               \
   __ lw(T3, Address(T3, 0));                                                   \
   __ BranchUnsignedGreaterEqual(T1, T3, &fall_through);                        \
                                                                                \
   /* Successfully allocated the object(s), now update top to point to */       \
@@ skipping 1541 matching lines @@
 // Allocates one-byte string of length 'end - start'. The content is not
 // initialized.
 // 'length-reg' (T2) contains tagged length.
 // Returns new string as tagged pointer in V0.
 static void TryAllocateOnebyteString(Assembler* assembler,
                                      Label* ok,
                                      Label* failure) {
   const Register length_reg = T2;
 
   __ mov(T6, length_reg);  // Save the length register.
+  // TODO(koda): Protect against negative length and overflow here.
   __ SmiUntag(length_reg);
   const intptr_t fixed_size = sizeof(RawString) + kObjectAlignment - 1;
   __ AddImmediate(length_reg, fixed_size);
   __ LoadImmediate(TMP, ~(kObjectAlignment - 1));
   __ and_(length_reg, length_reg, TMP);
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
   const intptr_t cid = kOneByteStringCid;
   Heap::Space space = heap->SpaceForAllocation(cid);
   __ LoadImmediate(T3, heap->TopAddress(space));
   __ lw(V0, Address(T3, 0));
 
   // length_reg: allocation size.
-  __ AdduDetectOverflow(T1, V0, length_reg, CMPRES1);
-  __ bltz(CMPRES1, failure);  // Fail on overflow.
+  __ addu(T1, V0, length_reg);
+  __ BranchUnsignedLess(T1, V0, failure);  // Fail on unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // V0: potential new object start.
   // T1: potential next object start.
   // T2: allocation size.
   // T3: heap->TopAddress(space).
   __ LoadImmediate(T4, heap->EndAddress(space));
   __ lw(T4, Address(T4, 0));
   __ BranchUnsignedGreaterEqual(T1, T4, failure);
 
@@ skipping 252 matching lines @@
   Isolate* isolate = Isolate::Current();
   __ LoadImmediate(V0, reinterpret_cast<uword>(isolate));
   // Set return value.
   __ Ret();
   __ delay_slot()->lw(V0, Address(V0, Isolate::current_tag_offset()));
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS