ia32 crash when compiler contains spread literal

[stereotype441]

Steps to reproduce:

git fetch https://dart.googlesource.com/sdk refs/changes/40/166040/3 && git checkout FETCH_HEAD
gclient sync
./tools/build.py --mode debug --arch ia32 create_sdk run_vm_tests
python tools/test.py -n dartk-linux-debug-ia32-canary vm/dart_2/entrypoints/jit/static_this_test/0

This produces the crash:

../../runtime/vm/compiler/backend/flow_graph.cc: 1460: error: expected: (index < phi->block()->phis()->length()) && ((*phi->block()->phis())[index] == phi)
version=2.11.0-edge.ac994df71bd394926cc775fb74bde8b71d685183 (be) (Mon Oct 5 18:36:54 2020 +0000) on "linux_ia32"
pid=3807716, thread=3807718, isolate_group=kernel-service(0x41fa900), isolate=kernel-service(0x420bb80)
isolate_instructions=0, vm_instructions=1bfd000
  pc 0x01fae41c fp 0xf776d858 dart::Profiler::DumpStackTrace(void*)+0x5c
  pc 0x025045a4 fp 0xf776d878 Dart_DumpNativeStackTrace+0x14
  pc 0x01bfd0bb fp 0xf776d8a8 dart::Assert::Fail(char const*, ...)+0x2b
  pc 0x02333b14 fp 0xf776d928 dart::FlowGraph::RenameRecursive(dart::BlockEntryInstr*, dart::GrowableArray<dart::Definition*>*, dart::GrowableArray<dart::PhiInstr*>*, dart::VariableLivenessAnalysis*, dart::ZoneGrowableArray<dart::Definition*>*)+0xca4
...

The following change works around the crash:

diff --git a/pkg/front_end/lib/src/fasta/type_inference/type_promotion.dart b/pkg/front_end/lib/src/fasta/type_inference/type_promotion.dart
index f80ba8d3b44..e926f6b1ec2 100644
--- a/pkg/front_end/lib/src/fasta/type_inference/type_promotion.dart
+++ b/pkg/front_end/lib/src/fasta/type_inference/type_promotion.dart
@@ -452,7 +452,7 @@ abstract class TypePromoterImpl extends TypePromoter {
           factMap[variable],
           isCheck.functionNestingLevel,
           isCheck.checkedType,
-          [...isCheck._blockingScopes, _currentScope]);
+          []..addAll(isCheck._blockingScopes)..add(_currentScope));
       factMap[variable] = facts;
       _factCacheState = facts;
     }

[a-siva]

/cc @alexmarkov

[alexmarkov]

Minimal repro:

class Foo {
  Foo(List<Object> sc);
}

void foo(List<Object> objects) {
  Map<String, Object> map = {};
  final foo = new Foo([...objects]);
  map['hi'] = foo;
}

main() {
  foo(List.filled(30, Object()));
}

out/DebugX64/dart --optimization-counter-threshold=20 foo.dart