Guard against allocation top overflow in ObjectArray_Allocate intrinsic.

runtime/vm/intrinsifier_x64.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 39 matching lines @@
   __ cmpq(RDI, max_len);
   __ j(GREATER, &fall_through);
   intptr_t fixed_size = sizeof(RawArray) + kObjectAlignment - 1;
   __ leaq(RDI, Address(RDI, TIMES_4, fixed_size));  // RDI is a Smi.
   ASSERT(kSmiTagShift == 1);
   __ andq(RDI, Immediate(-kObjectAlignment));
 
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
 
-  // RDI: allocation size.
   __ movq(RAX, Immediate(heap->TopAddress()));
   __ movq(RAX, Address(RAX, 0));
-  __ leaq(RCX, Address(RAX, RDI, TIMES_1, 0));
+
+  // RDI: allocation size.
+  __ movq(RCX, RAX);
+  __ addq(RCX, RDI);
+  __ j(CARRY, &fall_through);
 
   // Check if the allocation fits into the remaining space.
   // RAX: potential new object start.
   // RCX: potential next object start.
   // RDI: allocation size.
   __ movq(R13, Immediate(heap->EndAddress()));
   __ cmpq(RCX, Address(R13, 0));
   __ j(ABOVE_EQUAL, &fall_through);
 
   // Successfully allocated the object(s), now update top to point to
@@ skipping 1304 matching lines @@
   __ LoadObject(RAX, bool_true);
   __ ret();
   return true;
 }
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64