DBC: Fix bugs with array allocation

runtime/vm/simulator_dbc.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include <setjmp.h>  // NOLINT
 #include <stdlib.h>
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_DBC)
 
@@ skipping 2820 matching lines @@
     Exit(thread, FP, SP + 3, pc);
     NativeArguments args(thread, 2, SP + 1, SP - 1);
     INVOKE_RUNTIME(DRT_AllocateObject, args);
     SP -= 1;  // Result is in SP - 1.
     DISPATCH();
   }
 
   {
     BYTECODE(CreateArrayOpt, A_B_C);
     const intptr_t length = Smi::Value(RAW_CAST(Smi, FP[rB]));
-    if (LIKELY(length <= Array::kMaxElements)) {
+    if (LIKELY(static_cast<uintptr_t>(length) <= Array::kMaxElements)) {
       const intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
       const intptr_t instance_size =
           (fixed_size + length*kWordSize) & ~(kObjectAlignment - 1);
       const uword start =
           thread->heap()->new_space()->TryAllocate(instance_size);
       if (LIKELY(start != 0)) {
         const intptr_t cid = kArrayCid;
         uword tags = 0;
         if (LIKELY(instance_size < RawObject::SizeTag::kMaxSizeTag)) {
           tags = RawObject::SizeTag::update(instance_size, tags);
@@ skipping 911 matching lines @@
   pc_ = pc;
   special_[kExceptionSpecialIndex] = raw_exception;
   special_[kStacktraceSpecialIndex] = raw_stacktrace;
   buf->Longjmp();
   UNREACHABLE();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_DBC