Check type bounds of redirecting factories (issue 14699).

runtime/vm/ast.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_AST_H_
 #define VM_AST_H_
 
 #include "platform/assert.h"
 #include "vm/allocation.h"
 #include "vm/growable_array.h"
@@ skipping 359 matching lines @@
     ASSERT(type_.IsZoneHandle());
     ASSERT(!type_.IsNull());
     ASSERT(type_.IsFinalized());
   }
 
   const AbstractType& type() const { return type_; }
 
   const char* TypeName() const;
 
   virtual const Instance* EvalConstExpr() const {
-    // TODO(regis): What if the type is malbounded?
-    if (!type_.IsInstantiated() || type_.IsMalformed()) {
+    if (!type_.IsInstantiated() ||
+        type_.IsMalformed() || type_.IsMalbounded()) {
       return NULL;
     }
     return &type();
   }
 
   virtual void VisitChildren(AstNodeVisitor* visitor) const { }
 
   DECLARE_COMMON_NODE_FUNCTIONS(TypeNode);
 
  private:
@@ skipping 1386 matching lines @@
   const intptr_t try_index_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(InlinedFinallyNode);
 };
 
 }  // namespace dart
 
 #undef DECLARE_COMMON_NODE_FUNCTIONS
 
 #endif  // VM_AST_H_