Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/assembler_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // NOLINT
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/assembler.h"
 #include "vm/longjump.h"
 #include "vm/runtime_entry.h"
@@ skipping 854 matching lines @@
                             Register temp_reg) {
   ASSERT(!in_delay_slot_);
   ASSERT(failure != NULL);
   if (FLAG_inline_alloc) {
     const intptr_t instance_size = cls.instance_size();
     Heap* heap = Isolate::Current()->heap();
     Heap::Space space = heap->SpaceForAllocation(cls.id());
     const uword top_address = heap->TopAddress(space);
     LoadImmediate(temp_reg, top_address);
     lw(instance_reg, Address(temp_reg));
+    // TODO(koda): Protect against unsigned overflow here.
     AddImmediate(instance_reg, instance_size);
 
     // instance_reg: potential next object start.
     const uword end_address = heap->EndAddress(space);
     ASSERT(top_address < end_address);
     lw(TMP, Address(temp_reg, end_address - top_address));
     // Fail if heap end unsigned less than or equal to instance_reg.
     BranchUnsignedLessEqual(TMP, instance_reg, failure);
 
     // Successfully allocated the object, now update top to point to
@@ skipping 22 matching lines @@
                                  Register end_address,
                                  Register temp1,
                                  Register temp2) {
   if (FLAG_inline_alloc) {
     Isolate* isolate = Isolate::Current();
     Heap* heap = isolate->heap();
     Heap::Space space = heap->SpaceForAllocation(cid);
     LoadImmediate(temp1, heap->TopAddress(space));
     lw(instance, Address(temp1, 0));  // Potential new object start.
     // Potential next object start.
-    AddImmediateDetectOverflow(end_address, instance, instance_size, CMPRES1);
-    bltz(CMPRES1, failure);  // CMPRES1 < 0 on overflow.
+    AddImmediate(end_address, instance, instance_size);
+    // Branch on unsigned overflow.
+    BranchUnsignedLess(end_address, instance, failure);
 
     // Check if the allocation fits into the remaining space.
     // instance: potential new object start.
     // end_address: potential next object start.
     LoadImmediate(temp2, heap->EndAddress(space));
     lw(temp2, Address(temp2, 0));
     BranchUnsignedGreaterEqual(end_address, temp2, failure);
 
 
     // Successfully allocated the object(s), now update top to point to
@@ skipping 280 matching lines @@
   Label stop;
   b(&stop);
   Emit(reinterpret_cast<int32_t>(message));
   Bind(&stop);
   break_(Instr::kStopMessageCode);
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS