Type and constant propagator should guard against mutable class ids.

runtime/vm/constant_propagator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/constant_propagator.h"
 
 #include "vm/bit_vector.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/flow_graph_compiler.h"
 #include "vm/flow_graph_range_analysis.h"
@@ skipping 765 matching lines @@
   SetValue(instr, non_constant_);
 }
 
 
 void ConstantPropagator::VisitLoadClassId(LoadClassIdInstr* instr) {
   intptr_t cid = instr->object()->Type()->ToCid();
   if (cid != kDynamicCid) {
     SetValue(instr, Smi::ZoneHandle(Z, Smi::New(cid)));
     return;
   }
+
   const Object& object = instr->object()->definition()->constant_value();
   if (IsConstant(object)) {
-    SetValue(instr, Smi::ZoneHandle(Z, Smi::New(object.GetClassId())));
-    return;
+    cid = object.GetClassId();
+    if (CheckClassInstr::IsImmutableClassId(cid)) {
+      SetValue(instr, Smi::ZoneHandle(Z, Smi::New(cid)));
+      return;
+    }
   }
   SetValue(instr, non_constant_);
 }
 
 
 void ConstantPropagator::VisitLoadField(LoadFieldInstr* instr) {
   Value* instance = instr->instance();
   if ((instr->recognized_kind() == MethodRecognizer::kObjectArrayLength) &&
       instance->definition()->OriginalDefinition()->IsCreateArray()) {
     Value* num_elements = instance->definition()->OriginalDefinition()
@@ skipping 858 matching lines @@
   graph_->MergeBlocks();
   GrowableArray<BitVector*> dominance_frontier;
   graph_->ComputeDominators(&dominance_frontier);
 
   if (FLAG_trace_constant_propagation) {
     FlowGraphPrinter::PrintGraph("After CP", graph_);
   }
 }
 
 }  // namespace dart