Fix array allocation overflow check on arm/arm64/mips.

runtime/vm/intrinsifier_arm.cc

Index: runtime/vm/intrinsifier_arm.cc
===================================================================
--- runtime/vm/intrinsifier_arm.cc	(revision 45266)
+++ runtime/vm/intrinsifier_arm.cc	(working copy)
@@ -211,7 +211,7 @@
                                                                                \
   /* R2: allocation size. */                                                   \
   __ add(R1, R0, Operand(R2));                                                 \

[zra, 2015/04/21 14:55:27]

adds

[koda, 2015/04/21 16:08:46]

Done.

-  __ b(&fall_through, VS);                                                     \
+  __ b(&fall_through, CS);  /* Fail on unsigned overflow. */                   \
                                                                                \
   /* Check if the allocation fits into the remaining space. */                 \
   /* R0: potential new object start. */                                        \
@@ -1653,6 +1653,7 @@
   Label fail;
 
   __ mov(R6, Operand(length_reg));  // Save the length register.
+  // TODO(koda): Protect against negative length and overflow here.
   __ SmiUntag(length_reg);
   const intptr_t fixed_size = sizeof(RawString) + kObjectAlignment - 1;
   __ AddImmediate(length_reg, fixed_size);
@@ -1667,7 +1668,7 @@
 
   // length_reg: allocation size.
   __ adds(R1, R0, Operand(length_reg));
-  __ b(&fail, VS);  // Fail on overflow.
+  __ b(&fail, CS);  // Fail on unsigned overflow.
 
   // Check if the allocation fits into the remaining space.
   // R0: potential new object start.