Fix 4182: When inlining StringBase_get_length, we cannot assume that all receivers where subclasse…

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/flow_graph_builder.h"
 #include "vm/il_printer.h"
 #include "vm/object_store.h"
 
@@ skipping 280 matching lines @@
         comp->InputAt(0),
         length_offset,
         Type::ZoneHandle(Type::IntInterface()));
     load->set_original(comp);
     load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     return true;
   }
 
   if (recognized_kind == MethodRecognizer::kStringBaseLength) {
+    if (!HasOneTarget(ic_data)) {
+      // Target is not only StringBase_get_length.
+      return false;
+    }
     ASSERT(HasOneTarget(ic_data));
     LoadVMFieldComp* load = new LoadVMFieldComp(
         comp->InputAt(0),
         String::length_offset(),
         Type::ZoneHandle(Type::IntInterface()));
     load->set_original(comp);
     load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     return true;
   }
@@ skipping 225 matching lines @@
       LocationSummary* locs = it.Current()->locs();
       if ((locs != NULL) && locs->is_call()) {
         is_leaf_ = false;
         return;
       }
     }
   }
 }
 
 }  // namespace dart