Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
 #include "vm/dart_entry.h"
 #include "vm/flow_graph_builder.h"
@@ skipping 2466 matching lines @@
   }
 }
 
 
 // Returns a Boolean constant if all classes in ic_data yield the same type-test
 // result and the type tests do not depend on type arguments. Otherwise return
 // Bool::null().
 RawBool* FlowGraphOptimizer::InstanceOfAsBool(const ICData& ic_data,
                                               const AbstractType& type) const {
   ASSERT(ic_data.num_args_tested() == 1);  // Unary checks only.
-  if (!type.IsInstantiated() || type.IsMalformed()) return Bool::null();
+  if (!type.IsInstantiated() || type.IsMalformed() || type.IsMalbounded(NULL)) {
+    return Bool::null();
+  }
   const Class& type_class = Class::Handle(type.type_class());
   if (type_class.HasTypeArguments()) {
     // Only raw types can be directly compared, thus disregarding type
     // arguments.
     const AbstractTypeArguments& type_arguments =
         AbstractTypeArguments::Handle(type.arguments());
     const bool is_raw_type = type_arguments.IsNull() ||
         type_arguments.IsRaw(type_arguments.Length());
     if (!is_raw_type) {
       // Unknown result.
@@ skipping 63 matching lines @@
 }
 
 
 void FlowGraphOptimizer::ReplaceWithTypeCast(InstanceCallInstr* call) {
   ASSERT(Token::IsTypeCastOperator(call->token_kind()));
   Definition* left = call->ArgumentAt(0);
   Definition* instantiator = call->ArgumentAt(1);
   Definition* type_args = call->ArgumentAt(2);
   const AbstractType& type =
       AbstractType::Cast(call->ArgumentAt(3)->AsConstant()->value());
-  ASSERT(!type.IsMalformed());
+  ASSERT(!type.IsMalformed() && !type.IsMalbounded(NULL));
   const ICData& unary_checks =
       ICData::ZoneHandle(call->ic_data()->AsUnaryClassChecks());
   if (unary_checks.NumberOfChecks() <= FLAG_max_polymorphic_checks) {
     Bool& as_bool = Bool::ZoneHandle(InstanceOfAsBool(unary_checks, type));
     if (as_bool.raw() == Bool::True().raw()) {
       AddReceiverCheck(call);
       // Remove the original push arguments.
       for (intptr_t i = 0; i < call->ArgumentCount(); ++i) {
         PushArgumentInstr* push = call->PushArgumentAt(i);
         push->ReplaceUsesWith(push->value()->definition());
@@ skipping 4925 matching lines @@
   }
 
   // Insert materializations at environment uses.
   for (intptr_t i = 0; i < exits.length(); i++) {
     CreateMaterializationAt(exits[i], alloc, alloc->cls(), *fields);
   }
 }
 
 
 }  // namespace dart