Consider upper bounds of type parameters in type checks.

runtime/vm/raw_object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/raw_object.h"
 
 #include "vm/class_table.h"
 #include "vm/freelist.h"
 #include "vm/isolate.h"
 #include "vm/object.h"
@@ skipping 323 matching lines @@
 
 intptr_t RawType::VisitTypePointers(
     RawType* raw_obj, ObjectPointerVisitor* visitor) {
   visitor->VisitPointers(raw_obj->from(), raw_obj->to());
   return Type::InstanceSize();
 }
 
 
 intptr_t RawTypeParameter::VisitTypeParameterPointers(
     RawTypeParameter* raw_obj, ObjectPointerVisitor* visitor) {
-  visitor->VisitPointer(reinterpret_cast<RawObject**>(&raw_obj->ptr()->name_));
+  visitor->VisitPointers(raw_obj->from(), raw_obj->to());
   return TypeParameter::InstanceSize();
 }
 
 
 intptr_t RawAbstractTypeArguments::VisitAbstractTypeArgumentsPointers(
     RawAbstractTypeArguments* raw_obj, ObjectPointerVisitor* visitor) {
   // RawAbstractTypeArguments is an abstract class.
   UNREACHABLE();
   return 0;
 }
@@ skipping 586 matching lines @@
 intptr_t RawJSRegExp::VisitJSRegExpPointers(RawJSRegExp* raw_obj,
                                             ObjectPointerVisitor* visitor) {
   // Make sure that we got here with the tagged pointer as this.
   ASSERT(raw_obj->IsHeapObject());
   intptr_t length = Smi::Value(raw_obj->ptr()->data_length_);
   visitor->VisitPointers(raw_obj->from(), raw_obj->to());
   return JSRegExp::InstanceSize(length);
 }
 
 }  // namespace dart