Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/stub_code_arm64.cc

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_ARM64)
 
 #include "vm/assembler.h"
 #include "vm/code_generator.h"
 #include "vm/compiler.h"
@@ skipping 641 matching lines @@
   // Load new object start and calculate next object start.
   // R1: array element type.
   // R2: array length as Smi.
   // R8: points to new space object.
   __ LoadFromOffset(R0, R8, top_offset, kNoPP);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ LoadImmediate(R3, fixed_size, kNoPP);
   __ add(R3, R3, Operand(R2, LSL, 2));  // R2 is Smi.
   ASSERT(kSmiTagShift == 1);
   __ andi(R3, R3, Immediate(~(kObjectAlignment - 1)));
+  // R0: potential new object start.
+  // R3: object size in bytes.
   __ adds(R7, R3, Operand(R0));
-  __ b(&slow_case, VS);
+  __ b(&slow_case, CS);  // Branch if unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // R0: potential new object start.
   // R1: array element type.
   // R2: array length as Smi.
   // R3: array size.
   // R7: potential next object start.
   // R8: points to new space object.
   __ LoadFromOffset(TMP, R8, end_offset, kNoPP);
   __ CompareRegisters(R7, TMP);
@@ skipping 1428 matching lines @@
   const Register right = R0;
   __ LoadFromOffset(left, SP, 1 * kWordSize, kNoPP);
   __ LoadFromOffset(right, SP, 0 * kWordSize, kNoPP);
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp);
   __ ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM64