Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/assembler_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // NOLINT
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/assembler.h"
 #include "vm/cpu.h"
 #include "vm/longjump.h"
@@ skipping 3369 matching lines @@
   if (FLAG_inline_alloc) {
     ASSERT(instance_reg != temp_reg);
     ASSERT(temp_reg != IP);
     const intptr_t instance_size = cls.instance_size();
     ASSERT(instance_size != 0);
     Heap* heap = Isolate::Current()->heap();
     Heap::Space space = heap->SpaceForAllocation(cls.id());
     const uword top_address = heap->TopAddress(space);
     LoadImmediate(temp_reg, top_address);
     ldr(instance_reg, Address(temp_reg));
-    AddImmediate(instance_reg, instance_size);
+    // TODO(koda): Protect against unsigned overflow here.
+    AddImmediateSetFlags(instance_reg, instance_reg, instance_size);
 
     // instance_reg: potential next object start.
     const uword end_address = heap->EndAddress(space);
     ASSERT(top_address < end_address);
     // Could use ldm to load (top, end), but no benefit seen experimentally.
     ldr(IP, Address(temp_reg, end_address - top_address));
     cmp(IP, Operand(instance_reg));
     // fail if heap end unsigned less than or equal to instance_reg.
     b(failure, LS);
 
@@ skipping 26 matching lines @@
                                  Register instance,
                                  Register end_address,
                                  Register temp1,
                                  Register temp2) {
   if (FLAG_inline_alloc) {
     Isolate* isolate = Isolate::Current();
     Heap* heap = isolate->heap();
     Heap::Space space = heap->SpaceForAllocation(cid);
     LoadImmediate(temp1, heap->TopAddress(space));
     ldr(instance, Address(temp1, 0));  // Potential new object start.
-    AddImmediate(end_address, instance, instance_size);
-    b(failure, VS);
+    AddImmediateSetFlags(end_address, instance, instance_size);
+    b(failure, CS);  // Branch if unsigned overflow.
 
     // Check if the allocation fits into the remaining space.
     // instance: potential new object start.
     // end_address: potential next object start.
     LoadImmediate(temp2, heap->EndAddress(space));
     ldr(temp2, Address(temp2, 0));
     cmp(end_address, Operand(temp2));
     b(failure, CS);
 
     LoadAllocationStatsAddress(temp2, cid, space);
@@ skipping 127 matching lines @@
 
 
 const char* Assembler::FpuRegisterName(FpuRegister reg) {
   ASSERT((0 <= reg) && (reg < kNumberOfFpuRegisters));
   return fpu_reg_names[reg];
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM