Fix intrinsified allocation of arrays which cuased crash on ia32: do not allow allocation of arrays…

runtime/vm/intrinsifier_x64.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 26 matching lines @@
 
   // Compute the size to be allocated, it is based on the array length
   // and is computed as:
   // RoundedAllocationSize((array_length * kwordSize) + sizeof(RawArray)).
   __ movq(RDI, Address(RSP, kArrayLengthOffset));  // Array Length.
   // Assert that length is a Smi.
   __ testq(RDI, Immediate(kSmiTagSize));
   __ j(NOT_ZERO, &fall_through);
   __ cmpq(RDI, Immediate(0));
   __ j(LESS, &fall_through);
+  // Check for maximum allowed length.
+  const Immediate max_len =
+      Immediate(reinterpret_cast<int64_t>(Smi::New(Array::kMaxElements)));
+  __ cmpq(RDI, max_len);
+  __ j(GREATER, &fall_through);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ leaq(RDI, Address(RDI, TIMES_4, fixed_size));  // RDI is a Smi.
   ASSERT(kSmiTagShift == 1);
   __ andq(RDI, Immediate(-kObjectAlignment));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
   // RDI: allocation size.
   __ movq(RAX, Immediate(heap->TopAddress()));
@@ skipping 1299 matching lines @@
   __ LoadObject(RAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64