Fix for issue 26243 - illegal motion of assignments in instruction merging

pkg/compiler/lib/src/ssa/types_propagation.dart

Index: pkg/compiler/lib/src/ssa/types_propagation.dart
diff --git a/pkg/compiler/lib/src/ssa/types_propagation.dart b/pkg/compiler/lib/src/ssa/types_propagation.dart
index 64e4c30167d96e72b3da950ac20f90d0c8d2a9fd..50409033b78b11abef15bd1c476a00464310d40e 100644
--- a/pkg/compiler/lib/src/ssa/types_propagation.dart
+++ b/pkg/compiler/lib/src/ssa/types_propagation.dart
@@ -200,11 +200,23 @@ class SsaTypePropagator extends HBaseVisitor implements OptimizationPhase {
       }
     }
     if (inputType != outputType) {
-      input.replaceAllUsersDominatedBy(instruction.next, instruction);
+      // Replace dominated uses of input with uses of this HTypeConversion so
+      // the uses benefit from the stronger type.
+      //
+      // The dependency on the checked value also improves the generated
+      // JavaScript. Many checks are compiled to a function call expression that
+      // returns the checked result, so the check can be generated as a
+      // subexpression rather than a separate statement.
+      //
+      // Do not replace local accesses, since the local must be a HLocalValue,
+      // not a HTypeConversion.
+      if (!(input is HParameterValue && input.usedAsVariable())) {
+        input.replaceAllUsersDominatedBy(instruction.next, instruction);
+      }
     }
     return outputType;
   }
-
+  
   TypeMask visitTypeKnown(HTypeKnown instruction) {
     HInstruction input = instruction.checkedInput;
     TypeMask inputType = input.instructionType;