Fix a crash when optimizing instance field increment: if the increment operation gets interrupted b…

runtime/vm/opt_code_generator_ia32.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/opt_code_generator.h"
 
 #include "vm/assembler_macros.h"
@@ skipping 1427 matching lines @@
   return true;
 }
 
 
 void OptimizingCodeGenerator::VisitIncrOpInstanceFieldNode(
     IncrOpInstanceFieldNode* node) {
   ASSERT((node->kind() == Token::kINCR) || (node->kind() == Token::kDECR));
   VisitLoadOne(node->receiver(), EBX);
   __ pushl(EBX);  // Duplicate receiver (preserve for setter).
   const ICData& ic_data = node->ICDataAtId(node->id());
-  if (ic_data.NumberOfChecks() == 0) {
+  // Deoptimize if either this node has never been visited before or
+  // if the classes collected at getter and setter do not match (can happen
+  // if the increment is 'interrupted' by an exception).
+  if ((ic_data.NumberOfChecks() == 0) ||
+       !HaveSameClassesInICData(node->ICDataAtId(node->getter_id()),
+                                node->ICDataAtId(node->setter_id()))) {
     // Deoptimization point for this node is after receiver has been
     // pushed twice on stack and before the getter (above) was executed.
     DeoptimizationBlob* deopt_blob =
         AddDeoptimizationBlob(node, EBX, kDeoptIncrInstance);
     __ jmp(deopt_blob->label());
     return;
   }
   InlineInstanceGetter(node,
                        node->getter_id(),
                        node->receiver(),
@@ skipping 1608 matching lines @@
     }
   }
   // TODO(srdjan): Implement unary kSUB (negate) Mint.
   CodeGenerator::VisitUnaryOpNode(node);
 }
 
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32