Fixes crashes in inliner: do not inline if icdata was cleared.

runtime/vm/flow_graph_inliner.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_inliner.h"
 
 #include "vm/aot_optimizer.h"
 #include "vm/block_scheduler.h"
 #include "vm/branch_optimizer.h"
 #include "vm/compiler.h"
@@ skipping 630 matching lines @@
 
     // Do not rely on function type feedback or presence of code to determine
     // if a function was compiled.
     if (!FLAG_precompiled_mode && !function.was_compiled()) {
       TRACE_INLINING(THR_Print("     Bailout: not compiled yet\n"));
       PRINT_INLINING_TREE("Not compiled",
           &call_data->caller, &function, call_data->call);
       return false;
     }
 
+    // Type feedback may have been cleared for this function (ClearICDataArray),
+    // but we need it for inlining.
+    if (!FLAG_precompiled_mode && (function.ic_data_array() == Array::null())) {
+      TRACE_INLINING(THR_Print("     Bailout: type feedback cleared\n"));
+      PRINT_INLINING_TREE("Not compiled",
+          &call_data->caller, &function, call_data->call);
+      return false;
+    }
+
     // Abort if this function has deoptimized too much.
     if (function.deoptimization_counter() >=
         FLAG_max_deoptimization_counter_threshold) {
       function.set_is_inlinable(false);
       TRACE_INLINING(THR_Print("     Bailout: deoptimization threshold\n"));
       PRINT_INLINING_TREE("Deoptimization threshold exceeded",
           &call_data->caller, &function, call_data->call);
       return false;
     }
 
@@ skipping 2427 matching lines @@
       return InlineDoubleOp(flow_graph, Token::kMUL, call, entry, last);
     case MethodRecognizer::kDoubleDiv:
       return InlineDoubleOp(flow_graph, Token::kDIV, call, entry, last);
     default:
       return false;
   }
 }
 
 
 }  // namespace dart