Add explicit class checks: LoadVMField.

runtime/vm/flow_graph_optimizer.cc

Index: runtime/vm/flow_graph_optimizer.cc
===================================================================
--- runtime/vm/flow_graph_optimizer.cc	(revision 11587)
+++ runtime/vm/flow_graph_optimizer.cc	(working copy)
@@ -521,13 +521,14 @@
       default:
         UNREACHABLE();
     }
+    // Check receiver class.
+    AddCheckClass(instr, comp, comp->ArgumentAt(0)->value()->CopyValue());
+
     LoadVMFieldComp* load = new LoadVMFieldComp(
         comp->ArgumentAt(0)->value(),
         length_offset,
         Type::ZoneHandle(Type::SmiType()));
     load->set_result_cid(kSmiCid);
-    load->set_original(comp);
-    load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     RemovePushArguments(comp);
     return true;
@@ -538,14 +539,14 @@
       // Target is not only StringBase_get_length.
       return false;
     }
-    ASSERT(HasOneTarget(ic_data));
+    // Check receiver class.
+    AddCheckClass(instr, comp, comp->ArgumentAt(0)->value()->CopyValue());
+
     LoadVMFieldComp* load = new LoadVMFieldComp(
         comp->ArgumentAt(0)->value(),
         String::length_offset(),
         Type::ZoneHandle(Type::SmiType()));
     load->set_result_cid(kSmiCid);
-    load->set_original(comp);
-    load->set_ic_data(comp->ic_data());
     instr->set_computation(load);
     RemovePushArguments(comp);
     return true;