Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/stub_code_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/assembler.h"
 #include "vm/code_generator.h"
 #include "vm/compiler.h"
@@ skipping 688 matching lines @@
 
   // T2: Allocation size.
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
   const intptr_t cid = kArrayCid;
   Heap::Space space = heap->SpaceForAllocation(cid);
   __ LoadImmediate(T3, heap->TopAddress(space));
   __ lw(T0, Address(T3, 0));  // Potential new object start.
 
-  __ AdduDetectOverflow(T1, T0, T2, CMPRES1);  // Potential next object start.
-  __ bltz(CMPRES1, &slow_case);  // CMPRES1 < 0 on overflow.
+  __ addu(T1, T0, T2);  // Potential next object start.
+  __ BranchUnsignedLess(T1, T0, &slow_case);  // Branch on unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // T0: potential new object start.
   // T1: potential next object start.
   // T2: allocation size.
   __ LoadImmediate(T4, heap->EndAddress(space));
   __ lw(T4, Address(T4, 0));
   __ BranchUnsignedGreaterEqual(T1, T4, &slow_case);
 
   // Successfully allocated the object(s), now update top to point to
@@ skipping 1530 matching lines @@
   const Register right = T0;
   __ lw(left, Address(SP, 1 * kWordSize));
   __ lw(right, Address(SP, 0 * kWordSize));
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp1, temp2);
   __ Ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS