Fix checked mode crash when clearing reaching type of a value.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/flow_graph_compiler.h"
@@ skipping 20 matching lines @@
 DEFINE_FLAG(bool, trace_range_analysis, false, "Trace range analysis progress");
 DEFINE_FLAG(bool, truncating_left_shift, true,
     "Optimize left shift to truncate if possible");
 DEFINE_FLAG(bool, use_cha, true, "Use class hierarchy analysis.");
 DECLARE_FLAG(bool, eliminate_type_checks);
 DECLARE_FLAG(bool, enable_type_checks);
 DECLARE_FLAG(bool, trace_type_check_elimination);
 
 
 
+// Optimize instance calls using ICData.
 void FlowGraphOptimizer::ApplyICData() {
   VisitBlocks();
 }
 
 
+// Optimize instance calls using cid.
 // Attempts to convert an instance call (IC call) using propagated class-ids,
-// e.g., receiver class id.
+// e.g., receiver class id, guarded-cid.
 void FlowGraphOptimizer::ApplyClassIds() {
   ASSERT(current_iterator_ == NULL);
   for (intptr_t i = 0; i < block_order_.length(); ++i) {
     BlockEntryInstr* entry = block_order_[i];
     ForwardInstructionIterator it(entry);
     current_iterator_ = &it;
     for (; !it.Done(); it.Advance()) {
       Instruction* instr = it.Current();
       if (instr->IsInstanceCall()) {
         InstanceCallInstr* call = instr->AsInstanceCall();
@@ skipping 1140 matching lines @@
       load->set_result_cid(field.guarded_cid());
     }
     load->set_field(&Field::ZoneHandle(field.raw()));
   }
   load->set_field_name(String::Handle(field.name()).ToCString());
 
   // Discard the environment from the original instruction because the load
   // can't deoptimize.
   call->RemoveEnvironment();
   ReplaceCall(call, load);
+
+  if (load->result_cid() != kDynamicCid) {
+    // Reset value types if guarded_cid was used.
+    for (Value::Iterator it(load->input_use_list()); !it.Done(); it.Advance()) {
+      it.Current()->SetReachingType(NULL);
+    }
+  }
 }
 
 
 void FlowGraphOptimizer::InlineArrayLengthGetter(InstanceCallInstr* call,
                                                  intptr_t length_offset,
                                                  bool is_immutable,
                                                  MethodRecognizer::Kind kind) {
   AddReceiverCheck(call);
 
   LoadFieldInstr* load = new LoadFieldInstr(
@@ skipping 3396 matching lines @@
   if (changed) {
     // We may have changed the block order and the dominator tree.
     flow_graph->DiscoverBlocks();
     GrowableArray<BitVector*> dominance_frontier;
     flow_graph->ComputeDominators(&dominance_frontier);
   }
 }
 
 
 }  // namespace dart