Let Instance::IsInstanceOf verify that the type we check against is not a

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 14178 matching lines @@
   ASSERT(field_offset != Class::kNoTypeArguments);
   SetFieldAtOffset(field_offset, value);
 }
 
 
 bool Instance::IsInstanceOf(const AbstractType& other,
                             const TypeArguments& other_instantiator,
                             Error* bound_error) const {
   ASSERT(other.IsFinalized());
   ASSERT(!other.IsDynamicType());
+  ASSERT(!other.IsTypeRef());  // Must be dereferenced at compile time.
   ASSERT(!other.IsMalformed());
   ASSERT(!other.IsMalbounded());
   if (other.IsVoidType()) {
     return false;
   }
   Zone* zone = Thread::Current()->zone();
   const Class& cls = Class::Handle(zone, clazz());
   if (cls.IsClosureClass()) {
     if (other.IsObjectType() || other.IsDartFunctionType()) {
       return true;
     }
     Function& other_signature = Function::Handle(zone);
     TypeArguments& other_type_arguments = TypeArguments::Handle(zone);
     // Note that we may encounter a bound error in checked mode.
     if (!other.IsInstantiated()) {
-      const AbstractType& instantiated_other = AbstractType::Handle(
+      AbstractType& instantiated_other = AbstractType::Handle(
           zone, other.InstantiateFrom(other_instantiator, bound_error,
                                       NULL, NULL, Heap::kOld));
       if ((bound_error != NULL) && !bound_error->IsNull()) {
         ASSERT(Isolate::Current()->flags().type_checks());
         return false;
       }
+      if (instantiated_other.IsTypeRef()) {
+        instantiated_other = TypeRef::Cast(instantiated_other).type();
+      }
       if (instantiated_other.IsDynamicType() ||
           instantiated_other.IsObjectType() ||
           instantiated_other.IsDartFunctionType()) {
         return true;
       }
       if (!instantiated_other.IsFunctionType()) {
         return false;
       }
       other_signature = FunctionType::Cast(instantiated_other).signature();
       other_type_arguments = instantiated_other.arguments();
@@ skipping 7197 matching lines @@
   return UserTag::null();
 }
 
 
 const char* UserTag::ToCString() const {
   const String& tag_label = String::Handle(label());
   return tag_label.ToCString();
 }
 
 }  // namespace dart