Fix bug in double unboxing.

runtime/vm/intermediate_language_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM.
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/intermediate_language.h"
 
 #include "vm/dart_entry.h"
@@ skipping 1661 matching lines @@
     DRegister fpu_temp = EvenDRegisterOf(locs()->temp(2).fpu_reg());
 
     Label store_pointer, copy_payload;
     __ LoadObject(temp, Field::ZoneHandle(field().raw()));
     __ ldr(temp2, FieldAddress(temp, Field::guarded_cid_offset()));
     __ CompareImmediate(temp2, kDoubleCid);
     __ b(&store_pointer, NE);
     __ ldr(temp2, FieldAddress(temp, Field::is_nullable_offset()));
     __ CompareImmediate(temp2, kNullCid);
     __ b(&store_pointer, EQ);
+    __ ldrb(temp2, FieldAddress(temp, Field::kind_bits_offset()));
+    __ tst(temp2, ShifterOperand(1 << Field::kUnboxingCandidateBit));
+    __ b(&store_pointer, EQ);
 
     __ ldr(temp, FieldAddress(instance_reg, field().Offset()));
     __ CompareImmediate(temp,
                         reinterpret_cast<intptr_t>(Object::null()));
     __ b(&copy_payload, NE);
 
     StoreInstanceFieldSlowPath* slow_path =
         new StoreInstanceFieldSlowPath(this);
     compiler->AddSlowPathCode(slow_path);
 
@@ skipping 3125 matching lines @@
   compiler->GenerateCall(token_pos(),
                          &label,
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM