MalformedType used for all invalid type annotations.

sdk/lib/_internal/compiler/implementation/ssa/bailout.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 class BailoutInfo {
   int instructionId;
   int bailoutId;
   BailoutInfo(this.instructionId, this.bailoutId);
@@ skipping 94 matching lines @@
                                 HType speculativeType) {
     // If the type itself is not valuable, do not generate a guard for it.
     if (!typeValuable(speculativeType)) return false;
 
     // Do not insert a type guard if the instruction has a type
     // annotation that disagrees with the speculated type.
     Element source = instruction.sourceElement;
     if (source != null) {
       DartType sourceType = source.computeType(compiler);
       DartType speculatedType = speculativeType.computeType(compiler);
-      if (speculatedType != null
-          && !compiler.types.isAssignable(speculatedType, sourceType)) {
+      if (speculatedType != null &&
+          !speculatedType.isMalformed &&
+          !sourceType.isMalformed &&
+          !compiler.types.isAssignable(speculatedType, sourceType)) {
         return false;
       }
     }
 
     // Insert type guards for recursive methods.
     if (isRecursiveMethod) return true;
 
     // Insert type guards if there are uses in loops.
     bool isNested(HBasicBlock inner, HBasicBlock outer) {
       if (identical(inner, outer)) return false;
@@ skipping 412 matching lines @@
         hasComplexBailoutTargets = true;
       }
     } else {
       hasComplexBailoutTargets = true;
       blocks.forEach((HBasicBlock block) {
         block.bailoutTargets.add(target);
       });
     }
   }
 }