Implement array bounds checks explicitly in the optimized IL.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/cha.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/hash_map.h"
 #include "vm/il_printer.h"
@@ skipping 211 matching lines @@
     case kGrowableObjectArrayCid: {
       Value* array = comp->ArgumentAt(0)->value();
       Value* index = comp->ArgumentAt(1)->value();
       // Insert class check and index smi checks and attach a copy of the
       // original environment because the operation can still deoptimize.
       AddCheckClass(instr, comp, array->CopyValue());
       InsertBefore(instr,
                    new CheckSmiComp(index->CopyValue(), comp),
                    instr->env(),
                    BindInstr::kUnused);
+      // Insert array bounds check.
+      InsertBefore(instr,
+                   new CheckArrayBoundComp(array->CopyValue(),
+                                           index->CopyValue(),
+                                           class_id,
+                                           comp),
+                   instr->env(),
+                   BindInstr::kUnused);
       Computation* array_op = NULL;
       if (op_kind == Token::kINDEX) {
-        array_op = new LoadIndexedComp(array, index, class_id, comp);
+        array_op = new LoadIndexedComp(array, index, class_id);
       } else {
         Value* value = comp->ArgumentAt(2)->value();
-        array_op = new StoreIndexedComp(array, index, value, class_id, comp);
+        array_op = new StoreIndexedComp(array, index, value, class_id);
       }
       array_op->set_ic_data(comp->ic_data());
       instr->set_computation(array_op);
       RemovePushArguments(comp);
       return true;
     }
     default:
       return false;
   }
 }
@@ skipping 811 matching lines @@
       DirectChainedHashMap<BindInstr*> child_map(*map);  // Copy map.
       OptimizeRecursive(child, &child_map);
     } else {
       OptimizeRecursive(child, map);  // Reuse map for the last child.
     }
   }
 }
 
 
 }  // namespace dart