Fix order of box and types for constructor-body invocations.

pkg/compiler/lib/src/ssa/builder.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 class SsaFunctionCompiler implements FunctionCompiler {
   SsaCodeGeneratorTask generator;
   SsaBuilderTask builder;
   SsaOptimizerTask optimizer;
@@ skipping 2210 matching lines @@
       FunctionSignature functionSignature = body.functionSignature;
       // Provide the parameters to the generative constructor body.
       functionSignature.orderedForEachParameter((ParameterElement parameter) {
         // If [parameter] is boxed, it will be a field in the box passed as the
         // last parameter. So no need to directly pass it.
         if (!localsHandler.isBoxed(parameter)) {
           bodyCallInputs.add(localsHandler.readLocal(parameter));
         }
       });
 
+      // If there are locals that escape (ie mutated in closures), we
+      // pass the box to the constructor.
+      // The box must be passed before any type variable.
+      ClosureScope scopeData = parameterClosureData.capturingScopes[node];
+      if (scopeData != null) {
+        bodyCallInputs.add(localsHandler.readLocal(scopeData.boxElement));
+      }
+
+      // Type variables arguments must come after the box (if there is one).
       ClassElement currentClass = constructor.enclosingClass;
       if (backend.classNeedsRti(currentClass)) {
         // If [currentClass] needs RTI, we add the type variables as
         // parameters of the generative constructor body.
         currentClass.typeVariables.forEach((TypeVariableType argument) {
           // TODO(johnniwinther): Substitute [argument] with
           // `localsHandler.substInContext(argument)`.
           bodyCallInputs.add(localsHandler.readLocal(
               localsHandler.getTypeVariableAsLocal(argument)));
         });
       }
 
-      // If there are locals that escape (ie mutated in closures), we
-      // pass the box to the constructor.
-      ClosureScope scopeData = parameterClosureData.capturingScopes[node];
-      if (scopeData != null) {
-        bodyCallInputs.add(localsHandler.readLocal(scopeData.boxElement));
-      }
-
       if (!isNativeUpgradeFactory && // TODO(13836): Fix inlining.
           tryInlineMethod(body, null, bodyCallInputs, function)) {
         pop();
       } else {
         HInvokeConstructorBody invoke = new HInvokeConstructorBody(
             body.declaration, bodyCallInputs, backend.nonNullType);
         invoke.sideEffects =
             compiler.world.getSideEffectsOfElement(constructor);
         add(invoke);
       }
@@ skipping 4662 matching lines @@
     if (unaliased is TypedefType) throw 'unable to unalias $type';
     unaliased.accept(this, builder);
   }
 
   void visitDynamicType(DynamicType type, SsaBuilder builder) {
     JavaScriptBackend backend = builder.compiler.backend;
     ClassElement cls = backend.findHelper('DynamicRuntimeType');
     builder.push(new HDynamicType(type, new TypeMask.exact(cls, classWorld)));
   }
 }