Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/assembler_arm64.cc

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // NOLINT
 #if defined(TARGET_ARCH_ARM64)
 
 #include "vm/assembler.h"
 #include "vm/cpu.h"
 #include "vm/longjump.h"
@@ skipping 1355 matching lines @@
                             Register temp_reg,
                             Register pp) {
   ASSERT(failure != NULL);
   if (FLAG_inline_alloc) {
     const intptr_t instance_size = cls.instance_size();
     Heap* heap = Isolate::Current()->heap();
     Heap::Space space = heap->SpaceForAllocation(cls.id());
     const uword top_address = heap->TopAddress(space);
     LoadImmediate(temp_reg, top_address, pp);
     ldr(instance_reg, Address(temp_reg));
-    AddImmediate(instance_reg, instance_reg, instance_size, pp);
+    // TODO(koda): Protect against unsigned overflow here.
+    AddImmediateSetFlags(instance_reg, instance_reg, instance_size, pp);
 
     // instance_reg: potential next object start.
     const uword end_address = heap->EndAddress(space);
     ASSERT(top_address < end_address);
     // Could use ldm to load (top, end), but no benefit seen experimentally.
     ldr(TMP, Address(temp_reg, end_address - top_address));
     CompareRegisters(TMP, instance_reg);
     // fail if heap end unsigned less than or equal to instance_reg.
     b(failure, LS);
 
@@ skipping 24 matching lines @@
                                  Register instance,
                                  Register end_address,
                                  Register temp1,
                                  Register temp2) {
   if (FLAG_inline_alloc) {
     Isolate* isolate = Isolate::Current();
     Heap* heap = isolate->heap();
     Heap::Space space = heap->SpaceForAllocation(cid);
     LoadImmediate(temp1, heap->TopAddress(space), PP);
     ldr(instance, Address(temp1, 0));  // Potential new object start.
-    AddImmediate(end_address, instance, instance_size, PP);
-    b(failure, VS);
+    AddImmediateSetFlags(end_address, instance, instance_size, PP);
+    b(failure, CS);  // Fail on unsigned overflow.
 
     // Check if the allocation fits into the remaining space.
     // instance: potential new object start.
     // end_address: potential next object start.
     LoadImmediate(temp2, heap->EndAddress(space), PP);
     ldr(temp2, Address(temp2, 0));
     cmp(end_address, Operand(temp2));
     b(failure, CS);
 
     // Successfully allocated the object(s), now update top to point to
@@ skipping 52 matching lines @@
     add(base, array, Operand(index, LSL, shift));
   }
   const OperandSize size = Address::OperandSizeFor(cid);
   ASSERT(Address::CanHoldOffset(offset, Address::Offset, size));
   return Address(base, offset, Address::Offset, size);
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM64