Support new malformed types semantics.

sdk/lib/_internal/compiler/implementation/ssa/codegen.dart

Index: sdk/lib/_internal/compiler/implementation/ssa/codegen.dart
diff --git a/sdk/lib/_internal/compiler/implementation/ssa/codegen.dart b/sdk/lib/_internal/compiler/implementation/ssa/codegen.dart
index e522e72df89664d09cbf65b6bed9611895a4b439..cae0659726a88b48ffa0c3182d70b161a73a7777 100644
--- a/sdk/lib/_internal/compiler/implementation/ssa/codegen.dart
+++ b/sdk/lib/_internal/compiler/implementation/ssa/codegen.dart
@@ -2206,8 +2206,6 @@ abstract class SsaCodeGenerator implements HVisitor, HBlockInformationVisitor {
   }
 
   void checkType(HInstruction input, DartType type, {bool negative: false}) {
-    assert(invariant(input, !type.isMalformed,
-                     message: 'Attempt to check malformed type $type'));
     Element element = type.element;
     if (element == backend.jsArrayClass) {
       checkArray(input, negative ? '!==': '===');
@@ -2338,8 +2336,7 @@ abstract class SsaCodeGenerator implements HVisitor, HBlockInformationVisitor {
       ClassElement objectClass = compiler.objectClass;
       Element element = type.element;
 
-      if (identical(element, objectClass) ||
-          identical(element, compiler.dynamicClass)) {
+      if (identical(element, objectClass) || type.treatAsDynamic) {
         // The constant folder also does this optimization, but we make
         // it safe by assuming it may have not run.
         push(newLiteralBool(!negative), node);