Recognize List constructor and turn it into CreateArray ...

runtime/vm/stub_code_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/assembler.h"
 #include "vm/compiler.h"
 #include "vm/dart_entry.h"
@@ skipping 602 matching lines @@
     // Compute the size to be allocated, it is based on the array length
     // and is computed as:
     // RoundedAllocationSize((array_length * kwordSize) + sizeof(RawArray)).
     // Assert that length is a Smi.
     __ testl(EDX, Immediate(kSmiTagMask));
     if (FLAG_use_slow_path) {
       __ jmp(&slow_case);
     } else {
       __ j(NOT_ZERO, &slow_case);
     }
+    __ cmpl(EDX, Immediate(0));
+    __ j(LESS,  &slow_case);
+
+    // Check for maximum allowed length.
+    const Immediate& max_len =
+        Immediate(reinterpret_cast<int32_t>(Smi::New(Array::kMaxElements)));
+    __ cmpl(EDX, max_len);
+    __ j(GREATER, &slow_case);
+
     __ movl(EDI, FieldAddress(CTX, Context::isolate_offset()));
     __ movl(EDI, Address(EDI, Isolate::heap_offset()));
     __ movl(EDI, Address(EDI, Heap::new_space_offset()));
 
     // Calculate and align allocation size.
     // Load new object start and calculate next object start.
     // ECX: array element type.
     // EDX: Array length as Smi.
     // EDI: Points to new space object.
     __ movl(EAX, Address(EDI, Scavenger::top_offset()));
     intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
     __ leal(EBX, Address(EDX, TIMES_2, fixed_size));  // EDX is Smi.
     ASSERT(kSmiTagShift == 1);
     __ andl(EBX, Immediate(-kObjectAlignment));
-    __ leal(EBX, Address(EAX, EBX, TIMES_1, 0));
+
+    // Check for overflow.
+    __ addl(EBX, EAX);
+    __ j(CARRY, &slow_case);
 
     // Check if the allocation fits into the remaining space.
     // EAX: potential new object start.
     // EBX: potential next object start.
     // ECX: array element type.
     // EDX: Array length as Smi.
     // EDI: Points to new space object.
     __ cmpl(EBX, Address(EDI, Scavenger::end_offset()));
     __ j(ABOVE_EQUAL, &slow_case);
 
@@ skipping 1265 matching lines @@
   const Register temp = ECX;
   __ movl(left, Address(ESP, 2 * kWordSize));
   __ movl(right, Address(ESP, 1 * kWordSize));
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp);
   __ ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32