Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/flow_graph_compiler.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_XXX.
 
 #include "vm/flow_graph_compiler.h"
 
 #include "vm/cha.h"
 #include "vm/dart_entry.h"
@@ skipping 1080 matching lines @@
       return TwoByteString::data_offset();
     default:
       UNIMPLEMENTED();
       return Array::data_offset();
   }
 }
 
 
 // Returns true if checking against this type is a direct class id comparison.
 bool FlowGraphCompiler::TypeCheckAsClassEquality(const AbstractType& type) {
-  ASSERT(type.IsFinalized() && !type.IsMalformed());
+  ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded());
   // Requires CHA, which can be applied in optimized code only,
   if (!FLAG_use_cha || !is_optimizing()) return false;
   if (!type.IsInstantiated()) return false;
   const Class& type_class = Class::Handle(type.type_class());
   // Signature classes have different type checking rules.
   if (type_class.IsSignatureClass()) return false;
   // Could be an interface check?
   if (type_class.is_implemented()) return false;
   const intptr_t type_cid = type_class.id();
   if (CHA::HasSubclasses(type_cid)) return false;
@@ skipping 26 matching lines @@
 
   for (int i = 0; i < len; i++) {
     sorted->Add(CidTarget(ic_data.GetReceiverClassIdAt(i),
                           &Function::ZoneHandle(ic_data.GetTargetAt(i)),
                           ic_data.GetCountAt(i)));
   }
   sorted->Sort(HighestCountFirst);
 }
 
 }  // namespace dart