Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/stub_code_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/assembler.h"
 #include "vm/code_generator.h"
 #include "vm/cpu.h"
@@ skipping 623 matching lines @@
 
   // R8: Allocation size.
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
   const intptr_t cid = kArrayCid;
   Heap::Space space = heap->SpaceForAllocation(cid);
   __ LoadImmediate(R6, heap->TopAddress(space));
   __ ldr(R0, Address(R6, 0));  // Potential new object start.
   __ adds(R7, R0, Operand(R8));  // Potential next object start.
-  __ b(&slow_case, VS);
+  __ b(&slow_case, CS);  // Branch if unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // R0: potential new object start.
   // R7: potential next object start.
   // R8: allocation size.
   __ LoadImmediate(R3, heap->EndAddress(space));
   __ ldr(R3, Address(R3, 0));
   __ cmp(R7, Operand(R3));
   __ b(&slow_case, CS);
 
@@ skipping 1400 matching lines @@
   const Register right = R0;
   __ ldr(left, Address(SP, 1 * kWordSize));
   __ ldr(right, Address(SP, 0 * kWordSize));
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp);
   __ Ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM