Complete latest spec changes regarding malformed types (see issue 14006).

runtime/vm/object.cc

Index: runtime/vm/object.cc
===================================================================
--- runtime/vm/object.cc	(revision 29871)
+++ runtime/vm/object.cc	(working copy)
@@ -11439,8 +11439,11 @@
                             Error* bound_error) const {
   ASSERT(IsResolved());
   ASSERT(other.IsResolved());
-  ASSERT(!IsMalformed());
-  ASSERT(!other.IsMalformed());
+  if (IsMalformed() || other.IsMalformed()) {
+    // Caller must handle malformed types and not call this kIsSubtypeOf test.

[hausner, 2013/11/05 17:45:17]

the comment and the assertion mention different test_kind constants, which is a
bit confusing. 

[regis, 2013/11/05 18:05:11]

I rewrote the comment.

+    ASSERT(test_kind == kIsMoreSpecificThan);
+    return false;
+  }
   // In case the type checked in a type test is malbounded, the code generator
   // may compile a throw instead of a run time call performing the type check.
   // However, in checked mode, a function type may include malbounded result