Fix crash bug in the polymorphic inlining.

runtime/vm/flow_graph_inliner.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_inliner.h"
 
 #include "vm/compiler.h"
 #include "vm/flags.h"
 #include "vm/flow_graph.h"
 #include "vm/flow_graph_builder.h"
@@ skipping 1162 matching lines @@
       // Handle the two possible cases (unshared and shared subsequent
       // predecessors) separately.
       BlockEntryInstr* callee_entry = inlined_entries_[i];
       if (callee_entry->IsGraphEntry()) {
         // Unshared.  Graft the normal entry on after the check class
         // instruction.
         TargetEntryInstr* target =
             callee_entry->AsGraphEntry()->normal_entry();
         cursor->LinkTo(target->next());
         target->ReplaceAsPredecessorWith(current_block);
+        // Unuse all inputs of the graph entry and the normal entry. They are
+        // not in the graph anymore.
+        callee_entry->UnuseAllInputs();
+        target->UnuseAllInputs();
         // All blocks that were dominated by the normal entry are now
         // dominated by the current block.
         for (intptr_t j = 0;
              j < target->dominated_blocks().length();
              ++j) {
           BlockEntryInstr* block = target->dominated_blocks()[j];
           current_block->AddDominatedBlock(block);
         }
       } else if (callee_entry->IsJoinEntry()) {
         // Shared inlined body and this is a subsequent entry.  We have
@@ skipping 30 matching lines @@
       cursor = NULL;
 
       // 2. Handle a match by linking to the inlined body.  There are three
       // cases (unshared, shared first predecessor, and shared subsequent
       // predecessors).
       BlockEntryInstr* callee_entry = inlined_entries_[i];
       TargetEntryInstr* true_target = NULL;
       if (callee_entry->IsGraphEntry()) {
         // Unshared.
         true_target = callee_entry->AsGraphEntry()->normal_entry();
+        // Unuse all inputs of the graph entry. It is not in the graph anymore.
+        callee_entry->UnuseAllInputs();
       } else if (callee_entry->IsTargetEntry()) {
         // Shared inlined body and this is the first entry.  We have already
         // constructed a join and this target jumps to it.
         true_target = callee_entry->AsTargetEntry();
         BlockEntryInstr* join =
             true_target->last_instruction()->SuccessorAt(0);
         current_block->AddDominatedBlock(join);
       } else {
         // Shared inlined body and this is a subsequent entry.  We have
         // already constructed a join.  We need a fresh target that jumps to
@@ skipping 158 matching lines @@
         OS::Print("After Inlining of %s\n", flow_graph_->
                   parsed_function().function().ToFullyQualifiedCString());
         FlowGraphPrinter printer(*flow_graph_);
         printer.PrintBlocks();
       }
     }
   }
 }
 
 }  // namespace dart