Repro for OOM bug in test.dart (applies to r29345).

dart/sdk/lib/_internal/lib/js_rti.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 /**
  * This part contains helpers for supporting runtime type information.
  *
  * The helper use a mixture of Dart and JavaScript objects. To indicate which is
  * used where we adopt the scheme of using explicit type annotation for Dart
  * objects and 'var' or omitted return type for JavaScript objects.
@@ skipping 143 matching lines @@
     return 'dynamic';
   } else if (isJsArray(type)) {
     // A list representing a type with arguments.
     return getRuntimeTypeAsString(type);
   } else if (isJsFunction(type)) {
     // A reference to the constructor.
     return getConstructorName(type);
   } else if (type is int) {
     return type.toString();
   } else {
+    // TODO(ahe): Handle function types, and be sure to always return a string.
     return null;
   }
 }
 
 /**
  * Creates a comma-separated string of human-readable representations of the
  * type representations in the JavaScript array [types] starting at index
  * [startIndex].
  */
 String joinArguments(var types, int startIndex) {
@@ skipping 145 matching lines @@
 
   int len = getLength(s);
   for (int i = 0; i < len; i++) {
     if (!isSubtype(getIndex(s, i), getIndex(t, i))) {
       return false;
     }
   }
   return true;
 }
 
+// TODO(ahe): Remove this.
 Object functionSubtypeCast(Object object, String signatureName,
                            String contextName, var context,
                            var typeArguments) {
   if (!checkFunctionSubtype(object, signatureName,
                             contextName, context, typeArguments)) {
     String actualType = Primitives.objectTypeName(object);
     // TODO(johnniwinther): Provide better function type naming.
     String typeName = signatureName;
     throw new CastErrorImplementation(actualType, typeName);
   }
   return object;
 }
 
+// TODO(ahe): Remove this.
 Object assertFunctionSubtype(Object object, String signatureName,
                              String contextName, var context,
                              var typeArguments) {
   if (!checkFunctionSubtype(object, signatureName,
       contextName, context, typeArguments)) {
     // TODO(johnniwinther): Provide better function type naming.
     String typeName = signatureName;
     throw new TypeErrorImplementation(object, typeName);
   }
   return object;
 }
 
 /**
  * Checks that the type of [target] is a subtype of the function type denoted by
  * [signatureName]. If the type contains type variables, [contextName] holds the
  * name of the class where these were declared and either [context] holds the
  * object in which the runtime values of these can be found or [typeArguments]
  * contains these values as a list of runtime type information.
  */
+// TODO(ahe): Remove this.
 bool checkFunctionSubtype(var target, String signatureName,
                           String contextName, var context,
                           var typeArguments) {
   if (isNull(target)) return true;
   var interceptor = getInterceptor(target);
   if (hasField(interceptor, '${JS_OPERATOR_IS_PREFIX()}_$signatureName')) {
     return true;
   }
   var signatureLocation = JS_CURRENT_ISOLATE();
   if (isNotNull(contextName)) {
@@ skipping 122 matching lines @@
   if (getConstructorName(t) == JS_FUNCTION_CLASS_NAME() &&
       hasField(s, '${JS_FUNCTION_TYPE_TAG()}')) {
     return true;
   }
   // Get the object describing the class and check for the subtyping flag
   // constructed from the type of [t].
   var typeOfS = isJsArray(s) ? getIndex(s, 0) : s;
   var typeOfT = isJsArray(t) ? getIndex(t, 0) : t;
   // Check for a subtyping flag.
   var name = runtimeTypeToString(typeOfT);
-  var test = '${JS_OPERATOR_IS_PREFIX()}${name}';
-  if (hasNoField(typeOfS, test)) return false;
   // Get the necessary substitution of the type arguments, if there is one.
   var substitution;
   if (isNotIdentical(typeOfT, typeOfS)) {
+    var test = '${JS_OPERATOR_IS_PREFIX()}${name}';
+    if (hasNoField(typeOfS, test)) return false;
     var field = '${JS_OPERATOR_AS_PREFIX()}${runtimeTypeToString(typeOfT)}';
     substitution = getField(typeOfS, field);
   }
   // The class of [s] is a subclass of the class of [t].  If [s] has no type
   // arguments and no substitution, it is used as raw type.  If [t] has no
   // type arguments, it used as a raw type.  In both cases, [s] is a subtype
   // of [t].
   if ((!isJsArray(s) && isNull(substitution)) || !isJsArray(t)) {
     return true;
   }
@@ skipping 215 matching lines @@
  * and [t] are Dart values.
  */
 bool isIdentical(var s, var t) => JS('bool', '# === #', s, t);
 
 /**
  * Returns [:true:] if the JavaScript values [s] and [t] are not identical. We
  * use this helper to avoid generating code under the invalid assumption that
  * [s] and [t] are Dart values.
  */
 bool isNotIdentical(var s, var t) => JS('bool', '# !== #', s, t);