Fix for issue 8781: it is not ok to move a HTypeGuard, so mark it as "unpure".

sdk/lib/_internal/compiler/implementation/ssa/nodes.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 abstract class HVisitor<R> {
   R visitAdd(HAdd node);
   R visitBailoutTarget(HBailoutTarget node);
   R visitBitAnd(HBitAnd node);
@@ skipping 1199 matching lines @@
 
   void disable() {
     isEnabled = false;
     instructionType = guarded.instructionType;
   }
 
   bool isControlFlow() => true;
   bool isJsStatement() => isEnabled;
   bool canThrow() => isEnabled;
 
+  // A [HTypeGuard] cannot be moved anywhere in the graph, otherwise
+  // instructions that have side effects could end up before the guard
+  // in the otpimized version, and after the guard in a bailout
+  // version.
+  bool isPure() => false;
+
   accept(HVisitor visitor) => visitor.visitTypeGuard(this);
   int typeCode() => HInstruction.TYPE_GUARD_TYPECODE;
   bool typeEquals(other) => other is HTypeGuard;
   bool dataEquals(HTypeGuard other) => guardedType == other.guardedType;
 }
 
 class HBoundsCheck extends HCheck {
   static const int ALWAYS_FALSE = 0;
   static const int FULL_CHECK = 1;
   static const int ALWAYS_ABOVE_ZERO = 2;
@@ skipping 1326 matching lines @@
   HBasicBlock get start => expression.start;
   HBasicBlock get end {
     // We don't create a switch block if there are no cases.
     assert(!statements.isEmpty);
     return statements.last.end;
   }
 
   bool accept(HStatementInformationVisitor visitor) =>
       visitor.visitSwitchInfo(this);
 }