Fix assertion in ConstantPropagator::VisitInstanceOf.

runtime/vm/constant_propagator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/constant_propagator.h"
 
 #include "vm/bit_vector.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/flow_graph_compiler.h"
 #include "vm/flow_graph_range_analysis.h"
@@ skipping 725 matching lines @@
     SetValue(instr, Bool::Get(val));
   }
 }
 
 
 void ConstantPropagator::VisitInstanceOf(InstanceOfInstr* instr) {
   Definition* def = instr->value()->definition();
   const Object& value = def->constant_value();
   if (IsNonConstant(value)) {
     const AbstractType& checked_type = instr->type();
-    intptr_t value_cid = instr->value()->Type()->ToCid();
+    intptr_t value_cid = instr->value()->definition()->Type()->ToCid();
     Representation rep = def->representation();
     if ((checked_type.IsFloat32x4Type() && (rep == kUnboxedFloat32x4)) ||
         (checked_type.IsInt32x4Type() && (rep == kUnboxedInt32x4)) ||
         (checked_type.IsDoubleType() && (rep == kUnboxedDouble) &&
          FlowGraphCompiler::SupportsUnboxedDoubles()) ||
         (checked_type.IsIntType() && (rep == kUnboxedMint))) {
       // Ensure that compile time type matches representation.
       ASSERT(((rep == kUnboxedFloat32x4) && (value_cid == kFloat32x4Cid)) ||
              ((rep == kUnboxedInt32x4) && (value_cid == kInt32x4Cid)) ||
              ((rep == kUnboxedDouble) && (value_cid == kDoubleCid)) ||
@@ skipping 925 matching lines @@
   graph_->MergeBlocks();
   GrowableArray<BitVector*> dominance_frontier;
   graph_->ComputeDominators(&dominance_frontier);
 
   if (FLAG_trace_constant_propagation) {
     FlowGraphPrinter::PrintGraph("After CP", graph_);
   }
 }
 
 }  // namespace dart