Fix List length size check; add test.

runtime/vm/code_generator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/code_generator.h"
 
 #include "vm/assembler.h"
 #include "vm/ast.h"
 #include "vm/code_patcher.h"
 #include "vm/compiler.h"
@@ skipping 95 matching lines @@
 // Return value: newly allocated array of length arg0.
 DEFINE_RUNTIME_ENTRY(AllocateArray, 2) {
   const Instance& length = Instance::CheckedHandle(arguments.ArgAt(0));
   if (!length.IsSmi()) {
     const String& error = String::Handle(String::NewFormatted(
         "Length must be an integer in the range [0..%" Pd "].",
         Array::kMaxElements));
     Exceptions::ThrowArgumentError(error);
   }
   const intptr_t len = Smi::Cast(length).Value();
-  if (len < 0) {
+  if ((len < 0) || (len > Array::kMaxElements)) {
     const String& error = String::Handle(String::NewFormatted(
         "Length (%" Pd ") must be an integer in the range [0..%" Pd "].",
         len, Array::kMaxElements));
     Exceptions::ThrowArgumentError(error);
   }
 
   Heap::Space space = isolate->heap()->SpaceForAllocation(kArrayCid);
   const Array& array = Array::Handle(Array::New(len, space));
   arguments.SetReturn(array);
   TypeArguments& element_type =
@@ skipping 1550 matching lines @@
   const intptr_t elm_size = old_data.ElementSizeInBytes();
   const TypedData& new_data =
       TypedData::Handle(TypedData::New(cid, new_size, Heap::kOld));
   TypedData::Copy(new_data, 0, old_data, 0, old_size * elm_size);
   typed_data_cell.SetAt(0, new_data);
   arguments.SetReturn(new_data);
 }
 
 
 }  // namespace dart