From d8f223560aa60fcb6dfd648d58fc9b7614a3c2eb Mon Sep 17 00:00:00 2001
From: Florian Schneider <fschneider@google.com>
Date: Thu, 19 Jan 2017 10:25:23 -0800
Subject: [PATCH] Fix environment mismatch in AOT inlining.

When replacing _instanceOf with a cid range check, the
number of arguments passed as arguments changes.

The new environment must reflect this change.

The failing test is from #28431, but the bug itself has nothing to
do with checked mode.

R=rmacnak@google.com

Review-Url: https://codereview.chromium.org/2639273003 .
---
 runtime/vm/aot_optimizer.cc         | 7 +++++++
 runtime/vm/intermediate_language.cc | 5 +++++
 runtime/vm/intermediate_language.h  | 2 ++
 3 files changed, 14 insertions(+)

diff --git a/runtime/vm/aot_optimizer.cc b/runtime/vm/aot_optimizer.cc
index f630aae7fbe..57ff3497f32 100644
--- a/runtime/vm/aot_optimizer.cc
+++ b/runtime/vm/aot_optimizer.cc
@@ -1572,7 +1572,14 @@ void AotOptimizer::ReplaceWithInstanceOf(InstanceCallInstr* call) {
           new (Z) StaticCallInstr(call->token_pos(), target,
                                   Object::null_array(),  // argument_names
                                   args, call->deopt_id());
+      Environment* copy = call->env()->DeepCopy(
+          Z, call->env()->Length() - call->ArgumentCount());
+      for (intptr_t i = 0; i < args->length(); ++i) {
+        copy->PushValue(new (Z) Value((*args)[i]->value()->definition()));
+      }
+      call->RemoveEnvironment();
       ReplaceCall(call, new_call);
+      copy->DeepCopyTo(Z, new_call);
       return;
     }
   }
diff --git a/runtime/vm/intermediate_language.cc b/runtime/vm/intermediate_language.cc
index 007cb3655f0..9ca50407861 100644
--- a/runtime/vm/intermediate_language.cc
+++ b/runtime/vm/intermediate_language.cc
@@ -3327,6 +3327,11 @@ Environment* Environment::From(Zone* zone,
 }
 
 
+void Environment::PushValue(Value* value) {
+  values_.Add(value);
+}
+
+
 Environment* Environment::DeepCopy(Zone* zone, intptr_t length) const {
   ASSERT(length <= values_.length());
   Environment* copy = new (zone)
diff --git a/runtime/vm/intermediate_language.h b/runtime/vm/intermediate_language.h
index 82507f1745f..2543954c090 100644
--- a/runtime/vm/intermediate_language.h
+++ b/runtime/vm/intermediate_language.h
@@ -7908,6 +7908,8 @@ class Environment : public ZoneAllocated {
 
   Value* ValueAt(intptr_t ix) const { return values_[ix]; }
 
+  void PushValue(Value* value);
+
   intptr_t Length() const { return values_.length(); }
 
   Location LocationAt(intptr_t index) const {