Support new malformed types semantics.

sdk/lib/_internal/compiler/implementation/ssa/bailout.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 class BailoutInfo {
   int instructionId;
   int bailoutId;
   BailoutInfo(this.instructionId, this.bailoutId);
@@ skipping 123 matching lines @@
   bool typeGuardWouldBeValuable(HInstruction instruction,
                                 HType speculativeType) {
     // If the type itself is not valuable, do not generate a guard for it.
     if (!typeValuable(speculativeType)) return false;
 
     // Do not insert a type guard if the instruction has a type
     // annotation that disagrees with the speculated type.
     Element source = instruction.sourceElement;
     if (source != null) {
       DartType sourceType = source.computeType(compiler);
-      if (!sourceType.isMalformed && !sourceType.isDynamic &&
+      if (!sourceType.treatAsDynamic &&
           sourceType.kind == TypeKind.INTERFACE) {
         TypeMask sourceMask = new TypeMask.subtype(sourceType);
         TypeMask speculatedMask = speculativeType.computeMask(compiler);
         if (sourceMask.intersection(speculatedMask, compiler).isEmpty) {
           return false;
         }
       }
     }
 
     // Do not insert a type guard if one of the calls on it will hit
@@ skipping 545 matching lines @@
         hasComplexBailoutTargets = true;
       }
     } else {
       hasComplexBailoutTargets = true;
       blocks.forEach((HBasicBlock block) {
         block.bailoutTargets.add(target);
       });
     }
   }
 }