Fix crash https://code.google.com/p/dart/issues/detail?id=11793: only compute a range for a loop if…

sdk/lib/_internal/compiler/implementation/ssa/value_range_analyzer.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 
 class ValueRangeInfo {
   final ConstantSystem constantSystem;
 
@@ skipping 597 matching lines @@
   }
 
   Range visitParameterValue(HParameterValue parameter) {
     if (!parameter.isInteger()) return info.newUnboundRange();
     Value value = info.newInstructionValue(parameter);
     return info.newNormalizedRange(value, value);
   }
 
   Range visitPhi(HPhi phi) {
     if (!phi.isInteger()) return info.newUnboundRange();
+    // Some phases may replace instructions that change the inputs of
+    // this phi. Only the [SsaTypesPropagation] phase will update the
+    // phi type. Play it safe by assuming the [SsaTypesPropagation]
+    // phase is not necessarily run before the [ValueRangeAnalyzer].
+    if (phi.inputs.any((i) => !i.isInteger())) return info.newUnboundRange();
     if (phi.block.isLoopHeader()) {
       Range range = tryInferLoopPhiRange(phi);
       if (range == null) return info.newUnboundRange();
       return range;
     }
 
     Range range = ranges[phi.inputs[0]];
     for (int i = 1; i < phi.inputs.length; i++) {
       range = range.union(ranges[phi.inputs[i]]);
     }
@@ skipping 370 matching lines @@
     if (instruction is HPhi && !instruction.block.isLoopHeader()) {
       HInstruction result = unwrap(instruction.inputs[0]);
       for (int i = 1; i < instruction.inputs.length; i++) {
         if (result != unwrap(instruction.inputs[i])) return instruction;
       }
       return result;
     }
     return instruction;
   }
 }