Fix 11574: Smi is a subtype of parametrizable Compare.

runtime/vm/flow_graph_compiler_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "lib/error.h"
@@ skipping 215 matching lines @@
 FlowGraphCompiler::GenerateInstantiatedTypeWithArgumentsTest(
     intptr_t token_pos,
     const AbstractType& type,
     Label* is_instance_lbl,
     Label* is_not_instance_lbl) {
   __ Comment("InstantiatedTypeWithArgumentsTest");
   ASSERT(type.IsInstantiated());
   const Class& type_class = Class::ZoneHandle(type.type_class());
   ASSERT(type_class.HasTypeArguments());
   const Register kInstanceReg = EAX;
-  // A Smi object cannot be the instance of a parameterized class.
+  Error& malformed_error = Error::Handle();
+  const Type& int_type = Type::Handle(Type::IntType());
+  const bool smi_is_ok = int_type.IsSubtypeOf(type, &malformed_error);
+  // Malforrmed type should have been handled at graph construction time.
+  ASSERT(smi_is_ok || malformed_error.IsNull());
   __ testl(kInstanceReg, Immediate(kSmiTagMask));
-  __ j(ZERO, is_not_instance_lbl);
+  if (smi_is_ok) {
+    __ j(ZERO, is_instance_lbl);
+  } else {
+    __ j(ZERO, is_not_instance_lbl);
+  }
   const AbstractTypeArguments& type_arguments =
       AbstractTypeArguments::ZoneHandle(type.arguments());
   const bool is_raw_type = type_arguments.IsNull() ||
       type_arguments.IsRaw(type_arguments.Length());
   if (is_raw_type) {
     const Register kClassIdReg = ECX;
     // dynamic type argument, check only classes.
     __ LoadClassId(kClassIdReg, kInstanceReg);
     __ cmpl(kClassIdReg, Immediate(type_class.id()));
     __ j(EQUAL, is_instance_lbl);
@@ skipping 258 matching lines @@
     } else {
       __ j(ZERO, is_not_instance_lbl);
       __ CompareClassId(kInstanceReg, type_cid, EDI);
       __ j(EQUAL, is_instance_lbl);
     }
     __ jmp(is_not_instance_lbl);
     return SubtypeTestCache::null();
   }
   if (type.IsInstantiated()) {
     const Class& type_class = Class::ZoneHandle(type.type_class());
-    // A Smi object cannot be the instance of a parameterized class.
     // A class equality check is only applicable with a dst type of a
     // non-parameterized class or with a raw dst type of a parameterized class.
     if (type_class.HasTypeArguments()) {
       return GenerateInstantiatedTypeWithArgumentsTest(token_pos,
                                                        type,
                                                        is_instance_lbl,
                                                        is_not_instance_lbl);
       // Fall through to runtime call.
     }
     const bool has_fall_through =
@@ skipping 1372 matching lines @@
   __ movups(reg, Address(ESP, 0));
   __ addl(ESP, Immediate(kFpuRegisterSize));
 }
 
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32