Map malformed function result type and malformed function parameter type to

runtime/vm/class_finalizer.cc

Index: runtime/vm/class_finalizer.cc
===================================================================
--- runtime/vm/class_finalizer.cc	(revision 6776)
+++ runtime/vm/class_finalizer.cc	(working copy)
@@ -750,6 +750,10 @@
   }
   ResolveType(cls, type, result_finalization);
   type = FinalizeType(cls, type, result_finalization);
+  // In production mode, a malformed result type is mapped to Dynamic.
+  if (!FLAG_enable_type_checks && type.IsMalformed()) {
+    type = Type::DynamicType();
+  }
   function.set_result_type(type);
   // Resolve formal parameter types.
   const intptr_t num_parameters = function.NumberOfParameters();
@@ -757,6 +761,10 @@
     type = function.ParameterTypeAt(i);
     ResolveType(cls, type, kFinalize);
     type = FinalizeType(cls, type, kFinalize);
+    // In production mode, a malformed parameter type is mapped to Dynamic.
+    if (!FLAG_enable_type_checks && type.IsMalformed()) {
+      type = Type::DynamicType();
+    }
     function.SetParameterTypeAt(i, type);
   }
 }