Guard against allocation top overflow in ObjectArray_Allocate intrinsic.

runtime/vm/intrinsifier_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 //
 // The intrinsic code below is executed before a method has built its frame.
 // The return address is on the stack and the arguments below it.
 // Registers EDX (arguments descriptor) and ECX (function) must be preserved.
 // Each intrinsification method returns true if the corresponding
 // Dart method was intrinsified.
 
@@ skipping 40 matching lines @@
   __ cmpl(EDI, max_len);
   __ j(GREATER, &fall_through);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ leal(EDI, Address(EDI, TIMES_2, fixed_size));  // EDI is a Smi.
   ASSERT(kSmiTagShift == 1);
   __ andl(EDI, Immediate(-kObjectAlignment));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
+  __ movl(EAX, Address::Absolute(heap->TopAddress()));
+  __ movl(EBX, EAX);
+
   // EDI: allocation size.
-  __ movl(EAX, Address::Absolute(heap->TopAddress()));
-  __ leal(EBX, Address(EAX, EDI, TIMES_1, 0));
+  __ addl(EBX, EDI);
+  __ j(CARRY, &fall_through);
 
   // Check if the allocation fits into the remaining space.
   // EAX: potential new object start.
   // EBX: potential next object start.
   // EDI: allocation size.
   __ cmpl(EBX, Address::Absolute(heap->EndAddress()));
   __ j(ABOVE_EQUAL, &fall_through);
 
   // Successfully allocated the object(s), now update top to point to
   // next object start and initialize the object.
@@ skipping 1349 matching lines @@
   __ Bind(&is_true);
   __ LoadObject(EAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32