Fix bug in MegamorphicCacheMissHandler: put kNullCid into the cache when receiver is null.

runtime/vm/code_generator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/code_generator.h"
 
 #include "vm/assembler.h"
 #include "vm/ast.h"
 #include "vm/bigint_operations.h"
 #include "vm/code_patcher.h"
@@ skipping 996 matching lines @@
 DEFINE_RUNTIME_ENTRY(MegamorphicCacheMissHandler, 3) {
   ASSERT(arguments.ArgCount() ==
      kMegamorphicCacheMissHandlerRuntimeEntry.argument_count());
   const Instance& receiver = Instance::CheckedHandle(arguments.ArgAt(0));
   const ICData& ic_data = ICData::CheckedHandle(arguments.ArgAt(1));
   const Array& descriptor = Array::CheckedHandle(arguments.ArgAt(2));
   const String& name = String::Handle(ic_data.target_name());
   const MegamorphicCache& cache = MegamorphicCache::Handle(
       isolate->megamorphic_cache_table()->Lookup(name, descriptor));
   Class& cls = Class::Handle(receiver.clazz());
+  const bool is_null = cls.IsNullClass();
   // For lookups treat null as an instance of class Object.
-  if (cls.IsNullClass()) {
+  if (is_null) {
     cls = isolate->object_store()->object_class();
   }
   ASSERT(!cls.IsNull());
   if (FLAG_trace_ic || FLAG_trace_ic_miss_in_optimized) {
     OS::PrintErr("Megamorphic IC miss, class=%s, function=%s\n",
                  cls.ToCString(), name.ToCString());
   }
 
   intptr_t arg_count =
       Smi::Cast(Object::Handle(descriptor.At(0))).Value();
@@ skipping 13 matching lines @@
         Exceptions::PropagateError(error);
       }
     }
     ASSERT(target.HasCode());
     instructions = Code::Handle(target.CurrentCode()).instructions();
   }
   arguments.SetReturn(instructions);
   if (instructions.IsNull()) return;
 
   cache.EnsureCapacity();
-  const Smi& class_id = Smi::Handle(Smi::New(cls.id()));
+  const Smi& class_id = Smi::Handle(Smi::New(is_null ? kNullCid : cls.id()));
   cache.Insert(class_id, target);
   return;
 }
 
 
 // Updates IC data for two arguments. Used by the equality operation when
 // the control flow bypasses regular inline cache (null arguments).
 //   Arg0: Receiver object.
 //   Arg1: Argument after receiver.
 //   Arg2: Target's name.
@@ skipping 662 matching lines @@
 //   Arg1: Value that is being stored.
 DEFINE_RUNTIME_ENTRY(UpdateFieldCid, 2) {
   ASSERT(arguments.ArgCount() == kUpdateFieldCidRuntimeEntry.argument_count());
   const Field& field = Field::CheckedHandle(arguments.ArgAt(0));
   const Object& value = Object::Handle(arguments.ArgAt(1));
 
   field.UpdateCid(Class::Handle(value.clazz()).id());
 }
 
 }  // namespace dart