Fix array allocation overflow check on arm/arm64/mips.
When adding an object size in bytes to the allocation top address,
we must check for *unsigned* overflow, not signed overflow. 32-bit example:
if top is 0xfffff000 and size is 0x1008, then top + size is an unsigned,
but not a signed, overflow.
Add similar unit test for typed data (same issue).
BUG=23254
R=regis@google.com
Review URL: https://codereview.chromium.org//1096063002
git-svn-id: https://dart.googlecode.com/svn/branches/bleeding_edge/dart@45354 260f80e4-7a28-3924-810f-c04153c831b5
koda@google.com
db58faa53e