Fix off-by-one error in DBC interpreter

runtime/vm/simulator_dbc.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include <setjmp.h>  // NOLINT
 #include <stdlib.h>
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_DBC)
 
@@ skipping 2947 matching lines @@
     const intptr_t length = Smi::Value(RAW_CAST(Smi, FP[rB]));
     if (LIKELY(static_cast<uintptr_t>(length) <= Array::kMaxElements)) {
       const intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
       const intptr_t instance_size =
           (fixed_size + length * kWordSize) & ~(kObjectAlignment - 1);
       const uword start =
           thread->heap()->new_space()->TryAllocate(instance_size);
       if (LIKELY(start != 0)) {
         const intptr_t cid = kArrayCid;
         uword tags = 0;
-        if (LIKELY(instance_size < RawObject::SizeTag::kMaxSizeTag)) {
+        if (LIKELY(instance_size <= RawObject::SizeTag::kMaxSizeTag)) {
           tags = RawObject::SizeTag::update(instance_size, tags);
         }
         tags = RawObject::ClassIdTag::update(cid, tags);
         *reinterpret_cast<uword*>(start + Instance::tags_offset()) = tags;
         *reinterpret_cast<RawObject**>(start + Array::length_offset()) = FP[rB];
         *reinterpret_cast<RawObject**>(start + Array::type_arguments_offset()) =
             FP[rC];
         RawObject** data =
             reinterpret_cast<RawObject**>(start + Array::data_offset());
         for (intptr_t i = 0; i < length; i++) {
@@ skipping 904 matching lines @@
     pc_ = pc;
   }
 
   buf->Longjmp();
   UNREACHABLE();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_DBC