Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/code_generator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/code_generator.h"
 
 #include "vm/assembler.h"
 #include "vm/ast.h"
 #include "vm/bigint_operations.h"
 #include "vm/code_patcher.h"
@@ skipping 593 matching lines @@
       AbstractType::CheckedHandle(arguments.ArgAt(1));
   const Instance& dst_instantiator =
       Instance::CheckedHandle(arguments.ArgAt(2));
   const AbstractTypeArguments& instantiator_type_arguments =
       AbstractTypeArguments::CheckedHandle(arguments.ArgAt(3));
   const String& dst_name = String::CheckedHandle(arguments.ArgAt(4));
   const SubtypeTestCache& cache =
       SubtypeTestCache::CheckedHandle(arguments.ArgAt(5));
   ASSERT(!dst_type.IsDynamicType());  // No need to check assignment.
   ASSERT(!dst_type.IsMalformed());  // Already checked in code generator.
+  ASSERT(!dst_type.IsMalbounded());  // Already checked in code generator.
   ASSERT(!src_instance.IsNull());  // Already checked in inlined code.
 
   Error& malformed_error = Error::Handle();
   const bool is_instance_of = src_instance.IsInstanceOf(
       dst_type, instantiator_type_arguments, &malformed_error);
 
   if (FLAG_trace_type_checks) {
     PrintTypeCheck("TypeCheck",
                    src_instance, dst_type, instantiator_type_arguments,
                    is_instance_of ? Bool::True() : Bool::False());
@@ skipping 1266 matching lines @@
   field.UpdateCid(cid);
   intptr_t list_length = Field::kNoFixedLength;
   if ((field.guarded_cid() != kDynamicCid) &&
       field.is_final() && RawObject::IsBuiltinListClassId(cid)) {
     list_length = GetListLength(value);
   }
   field.UpdateLength(list_length);
 }
 
 }  // namespace dart