Add explicit class checks: LoadVMField.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/cha.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/hash_map.h"
 #include "vm/il_printer.h"
@@ skipping 503 matching lines @@
       case MethodRecognizer::kObjectArrayLength:
       case MethodRecognizer::kImmutableArrayLength:
         length_offset = Array::length_offset();
         break;
       case MethodRecognizer::kGrowableArrayLength:
         length_offset = GrowableObjectArray::length_offset();
         break;
       default:
         UNREACHABLE();
     }
+    // Check receiver class.
+    AddCheckClass(instr, comp, comp->ArgumentAt(0)->value()->CopyValue());
+
     LoadVMFieldComp* load = new LoadVMFieldComp(
         comp->ArgumentAt(0)->value(),
         length_offset,
         Type::ZoneHandle(Type::SmiType()));
     load->set_result_cid(kSmiCid);
-    load->set_original(comp);
-    load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     RemovePushArguments(comp);
     return true;
   }
 
   if (recognized_kind == MethodRecognizer::kStringBaseLength) {
     if (!HasOneTarget(ic_data)) {
       // Target is not only StringBase_get_length.
       return false;
     }
-    ASSERT(HasOneTarget(ic_data));
+    // Check receiver class.
+    AddCheckClass(instr, comp, comp->ArgumentAt(0)->value()->CopyValue());
+
     LoadVMFieldComp* load = new LoadVMFieldComp(
         comp->ArgumentAt(0)->value(),
         String::length_offset(),
         Type::ZoneHandle(Type::SmiType()));
     load->set_result_cid(kSmiCid);
-    load->set_original(comp);
-    load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     RemovePushArguments(comp);
     return true;
   }
   return false;
 }
 
 
 // Inline only simple, frequently called core library methods.
 bool FlowGraphOptimizer::TryInlineInstanceMethod(BindInstr* instr,
@@ skipping 510 matching lines @@
       DirectChainedHashMap<BindInstr*> child_map(*map);  // Copy map.
       OptimizeRecursive(child, &child_map);
     } else {
       OptimizeRecursive(child, map);  // Reuse map for the last child.
     }
   }
 }
 
 
 }  // namespace dart