Fix invalid aliasing in type propagation of AssertAssignable.

runtime/vm/flow_graph_type_propagator.cc

Index: runtime/vm/flow_graph_type_propagator.cc
===================================================================
--- runtime/vm/flow_graph_type_propagator.cc	(revision 31223)
+++ runtime/vm/flow_graph_type_propagator.cc	(working copy)
@@ -758,7 +758,7 @@
   CompileType* value_type = value()->Type();
 
   if (value_type->IsMoreSpecificThan(dst_type())) {
-    return value_type;
+    return ZoneCompileType::Wrap(*value_type);
   }
 
   if (dst_type().IsVoidType()) {
@@ -770,6 +770,14 @@
 }
 
 
+bool AssertAssignableInstr::RecomputeType() {
+  CompileType* value_type = value()->Type();
+  return UpdateType(value_type->IsMoreSpecificThan(dst_type())
+                      ? *value_type
+                      : CompileType::FromAbstractType(dst_type()));
+}
+
+
 CompileType AssertBooleanInstr::ComputeType() const {
   return CompileType::Bool();
 }