Version 0.2.9.6

Merge revision 16203 to trunk

This fixes a chrasher in dart2js, see issue 7411

git-svn-id: http://dart.googlecode.com/svn/trunk@16207 260f80e4-7a28-3924-810f-c04153c831b5
diff --git a/sdk/lib/_internal/compiler/implementation/ssa/builder.dart b/sdk/lib/_internal/compiler/implementation/ssa/builder.dart
index ebbec8c..8e51857 100644
--- a/sdk/lib/_internal/compiler/implementation/ssa/builder.dart
+++ b/sdk/lib/_internal/compiler/implementation/ssa/builder.dart
@@ -3239,8 +3239,15 @@
         member = member.getOutermostEnclosingMemberOrTopLevel();
       }
       if (member.isFactoryConstructor()) {
-        // The type variable is stored in a parameter of the factory.
-        inputs.add(localsHandler.readLocal(type.element));
+        if (localsHandler.isAccessedDirectly(type.element)
+            && !localsHandler.hasValueForDirectLocal(type.element)) {
+          // TODO(ahe): This is a hack to work around a compiler crash.
+          // Temporarily use "dynamic".
+          inputs.add(graph.addConstantNull(constantSystem));
+        } else {
+          // The type variable is stored in a parameter of the factory.
+          inputs.add(localsHandler.readLocal(type.element));
+        }
       } else if (member.isInstanceMember()
                  || member.isGenerativeConstructor()) {
         // The type variable is stored in [this].
diff --git a/tests/compiler/dart2js_extra/type_argument_factory_crash_test.dart b/tests/compiler/dart2js_extra/type_argument_factory_crash_test.dart
new file mode 100644
index 0000000..f6de717
--- /dev/null
+++ b/tests/compiler/dart2js_extra/type_argument_factory_crash_test.dart
@@ -0,0 +1,17 @@
+// Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// A regression test for a dart2js crash.
+
+void main() {
+  // This constructor call causes a crash in dart2js.
+  var o = new LinkedHashMap<int, int>();
+
+  // Comment out this line, the compiler doesn't crash.
+  Expect.isFalse(o is List<int>);
+
+  // Enable these two lines, the compiler doesn't crash.
+  // Expect.isTrue(o.keys is List<int>);
+  // Expect.isFalse(o.keys is List<String>);
+}
diff --git a/tests/compiler/dart2js_extra/type_argument_factory_nocrash_test.dart b/tests/compiler/dart2js_extra/type_argument_factory_nocrash_test.dart
new file mode 100644
index 0000000..607724f
--- /dev/null
+++ b/tests/compiler/dart2js_extra/type_argument_factory_nocrash_test.dart
@@ -0,0 +1,17 @@
+// Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// A regression test for a dart2js crash.
+
+void main() {
+  // This constructor call causes a crash in dart2js.
+  var o = new LinkedHashMap<int, int>();
+
+  // Comment out this line, the compiler doesn't crash.
+  Expect.isFalse(o is List<int>);
+
+  // Enable these two lines, the compiler doesn't crash.
+  Expect.isTrue(o.keys is List<int>);
+  Expect.isFalse(o.keys is List<String>);
+}
diff --git a/tools/VERSION b/tools/VERSION
index 18a30b6..077bc36 100644
--- a/tools/VERSION
+++ b/tools/VERSION
@@ -1,4 +1,4 @@
 MAJOR 0
 MINOR 2
 BUILD 9
-PATCH 5
+PATCH 6