Fix type checks that wrongly ignore malformed types.

runtime/vm/code_generator_ia32.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/code_generator.h"
 
 #include "lib/error.h"
@@ skipping 1414 matching lines @@
                                              intptr_t token_index,
                                              const AbstractType& dst_type,
                                              const String& dst_name) {
   ASSERT(FLAG_enable_type_checks);
   ASSERT(token_index >= 0);
   ASSERT(!dst_type.IsNull());
   ASSERT(dst_type.IsFinalized());
 
   // Any expression is assignable to the Dynamic type and to the Object type.
   // Skip the test.
-  if (dst_type.IsDynamicType() || dst_type.IsObjectType()) {
+  if (!dst_type.IsMalformed() &&
+      (dst_type.IsDynamicType() || dst_type.IsObjectType())) {
     return;
   }
 
   // It is a compile-time error to explicitly return a value (including null)
   // from a void function. However, functions that do not explicitly return a
   // value, implicitly return null. This includes void functions. Therefore, we
   // skip the type test here and trust the parser to only return null in void
   // function.
   if (dst_type.IsVoidType()) {
     return;
@@ skipping 14 matching lines @@
     __ PushObject(Object::ZoneHandle());  // Make room for the result.
     const Immediate location =
         Immediate(reinterpret_cast<int32_t>(Smi::New(token_index)));
     __ pushl(location);  // Push the source location.
     __ pushl(EAX);  // Push the source object.
     __ PushObject(dst_name);  // Push the name of the destination.
     __ PushObject(error_message);
     GenerateCallRuntime(node_id, token_index, kMalformedTypeErrorRuntimeEntry);
     // We should never return here.
     __ int3();
+
+    __ Bind(&done);  // For a null object.
     return;
   }
 
   // If dst_type is instantiated and non-parameterized, we can inline code
   // checking whether the assigned instance is a Smi.
   if (dst_type.IsInstantiated()) {
     const Class& dst_type_class = Class::ZoneHandle(dst_type.type_class());
     const bool dst_class_has_type_arguments = dst_type_class.HasTypeArguments();
     // A Smi object cannot be the instance of a parameterized class.
     // A class equality check is only applicable with a dst type of a
@@ skipping 1202 matching lines @@
   const Error& error = Error::Handle(
       Parser::FormatError(script, token_index, "Error", format, args));
   va_end(args);
   Isolate::Current()->long_jump_base()->Jump(1, error);
   UNREACHABLE();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32