Fix environment mismatch in AOT inlining.

When replacing _instanceOf with a cid range check, the
number of arguments passed as arguments changes.

The new environment must reflect this change.

The failing test is from #28431, but the bug itself has nothing to
do with checked mode.

R=rmacnak@google.com

Review-Url: https://codereview.chromium.org/2639273003 .

runtime/vm/aot_optimizer.cc

@@ -1572,7 +1572,14 @@ void AotOptimizer::ReplaceWithInstanceOf(InstanceCallInstr* call) {
           new (Z) StaticCallInstr(call->token_pos(), target,
                                   Object::null_array(),  // argument_names
                                   args, call->deopt_id());
+      Environment* copy = call->env()->DeepCopy(
+          Z, call->env()->Length() - call->ArgumentCount());
+      for (intptr_t i = 0; i < args->length(); ++i) {
+        copy->PushValue(new (Z) Value((*args)[i]->value()->definition()));
+      }
+      call->RemoveEnvironment();
       ReplaceCall(call, new_call);
+      copy->DeepCopyTo(Z, new_call);
       return;
     }
   }

runtime/vm/intermediate_language.cc

@@ -3327,6 +3327,11 @@ Environment* Environment::From(Zone* zone,
 }
 
 
+void Environment::PushValue(Value* value) {
+  values_.Add(value);
+}
+
+
 Environment* Environment::DeepCopy(Zone* zone, intptr_t length) const {
   ASSERT(length <= values_.length());
   Environment* copy = new (zone)

runtime/vm/intermediate_language.h

@@ -7908,6 +7908,8 @@ class Environment : public ZoneAllocated {
 
   Value* ValueAt(intptr_t ix) const { return values_[ix]; }
 
+  void PushValue(Value* value);
+
   intptr_t Length() const { return values_.length(); }
 
   Location LocationAt(intptr_t index) const {