Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/flow_graph_optimizer.cc

Index: runtime/vm/flow_graph_optimizer.cc
===================================================================
--- runtime/vm/flow_graph_optimizer.cc	(revision 26566)
+++ runtime/vm/flow_graph_optimizer.cc	(working copy)
@@ -2484,7 +2484,9 @@
 RawBool* FlowGraphOptimizer::InstanceOfAsBool(const ICData& ic_data,
                                               const AbstractType& type) const {
   ASSERT(ic_data.num_args_tested() == 1);  // Unary checks only.
-  if (!type.IsInstantiated() || type.IsMalformed()) return Bool::null();
+  if (!type.IsInstantiated() || type.IsMalformed() || type.IsMalbounded(NULL)) {
+    return Bool::null();
+  }
   const Class& type_class = Class::Handle(type.type_class());
   if (type_class.HasTypeArguments()) {
     // Only raw types can be directly compared, thus disregarding type
@@ -2568,7 +2570,7 @@
   Definition* type_args = call->ArgumentAt(2);
   const AbstractType& type =
       AbstractType::Cast(call->ArgumentAt(3)->AsConstant()->value());
-  ASSERT(!type.IsMalformed());
+  ASSERT(!type.IsMalformed() && !type.IsMalbounded(NULL));
   const ICData& unary_checks =
       ICData::ZoneHandle(call->ic_data()->AsUnaryClassChecks());
   if (unary_checks.NumberOfChecks() <= FLAG_max_polymorphic_checks) {