Let Instance::IsInstanceOf verify that the type we check against is not a

runtime/vm/object.cc

Index: runtime/vm/object.cc
diff --git a/runtime/vm/object.cc b/runtime/vm/object.cc
index 34e2d2af15cd9a9ce2c99f5217ca4173d75d7d08..c85afa2c21058d56586eadf69c79333f1ccf39b7 100644
--- a/runtime/vm/object.cc
+++ b/runtime/vm/object.cc
@@ -14196,6 +14196,7 @@ bool Instance::IsInstanceOf(const AbstractType& other,
                             Error* bound_error) const {
   ASSERT(other.IsFinalized());
   ASSERT(!other.IsDynamicType());
+  ASSERT(!other.IsTypeRef());  // Must be dereferenced at compile time.
   ASSERT(!other.IsMalformed());
   ASSERT(!other.IsMalbounded());
   if (other.IsVoidType()) {
@@ -14211,13 +14212,16 @@ bool Instance::IsInstanceOf(const AbstractType& other,
     TypeArguments& other_type_arguments = TypeArguments::Handle(zone);
     // Note that we may encounter a bound error in checked mode.
     if (!other.IsInstantiated()) {
-      const AbstractType& instantiated_other = AbstractType::Handle(
+      AbstractType& instantiated_other = AbstractType::Handle(
           zone, other.InstantiateFrom(other_instantiator, bound_error,
                                       NULL, NULL, Heap::kOld));
       if ((bound_error != NULL) && !bound_error->IsNull()) {
         ASSERT(Isolate::Current()->flags().type_checks());
         return false;
       }
+      if (instantiated_other.IsTypeRef()) {
+        instantiated_other = TypeRef::Cast(instantiated_other).type();
+      }
       if (instantiated_other.IsDynamicType() ||
           instantiated_other.IsObjectType() ||
           instantiated_other.IsDartFunctionType()) {