Fix intrinsified allocation of arrays which cuased crash on ia32: do not allow allocation of arrays…

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 27 matching lines @@
 
   // Compute the size to be allocated, it is based on the array length
   // and is computed as:
   // RoundedAllocationSize((array_length * kwordSize) + sizeof(RawArray)).
   __ movl(EDI, Address(ESP, kArrayLengthOffset));  // Array Length.
   // Assert that length is a Smi.
   __ testl(EDI, Immediate(kSmiTagSize));
   __ j(NOT_ZERO, &fall_through);
   __ cmpl(EDI, Immediate(0));
   __ j(LESS, &fall_through);
+  // Check for maximum allowed length.
+  const Immediate max_len =
+      Immediate(reinterpret_cast<int32_t>(Smi::New(Array::kMaxElements)));
+  __ cmpl(EDI, max_len);
+  __ j(GREATER, &fall_through);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ leal(EDI, Address(EDI, TIMES_2, fixed_size));  // EDI is a Smi.
   ASSERT(kSmiTagShift == 1);
   __ andl(EDI, Immediate(-kObjectAlignment));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
   // EDI: allocation size.
   __ movl(EAX, Address::Absolute(heap->TopAddress()));
@@ skipping 1343 matching lines @@
   __ Bind(&is_true);
   __ LoadObject(EAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32