Use a trail instead of a mark bit when processing recursive types in the VM

runtime/vm/code_generator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/code_generator.h"
 
 #include "vm/assembler.h"
 #include "vm/ast.h"
 #include "vm/bigint_operations.h"
 #include "vm/code_patcher.h"
@@ skipping 209 matching lines @@
   if (!bound_error.IsNull()) {
     // Throw a dynamic type error.
     const intptr_t location = GetCallerLocation();
     String& bound_error_message =  String::Handle(
         String::New(bound_error.ToErrorCString()));
     Exceptions::CreateAndThrowTypeError(
         location, Symbols::Empty(), Symbols::Empty(),
         Symbols::Empty(), bound_error_message);
     UNREACHABLE();
   }
+  if (type.IsTypeRef()) {
+    type = TypeRef::Cast(type).type();
+    ASSERT(!type.IsTypeRef());
+    ASSERT(type.IsCanonical());
+  }
   ASSERT(!type.IsNull() && type.IsInstantiated());
   arguments.SetReturn(type);
 }
 
 
 // Instantiate type arguments.
 // Arg0: uninstantiated type arguments.
 // Arg1: instantiator type arguments.
 // Return value: instantiated type arguments.
 DEFINE_RUNTIME_ENTRY(InstantiateTypeArguments, 2) {
@@ skipping 1475 matching lines @@
 // of the given value.
 //   Arg0: Field object;
 //   Arg1: Value that is being stored.
 DEFINE_RUNTIME_ENTRY(UpdateFieldCid, 2) {
   const Field& field = Field::CheckedHandle(arguments.ArgAt(0));
   const Object& value = Object::Handle(arguments.ArgAt(1));
   field.UpdateGuardedCidAndLength(value);
 }
 
 }  // namespace dart