Fix bug in double unboxing.

runtime/vm/intermediate_language_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/intermediate_language.h"
 
 #include "vm/dart_entry.h"
@@ skipping 1671 matching lines @@
     FpuRegister fpu_temp = locs()->temp(2).fpu_reg();
 
     Label store_pointer, copy_payload;
     __ LoadObject(temp, Field::ZoneHandle(field().raw()));
     __ cmpl(FieldAddress(temp, Field::guarded_cid_offset()),
             Immediate(kDoubleCid));
     __ j(NOT_EQUAL, &store_pointer);
     __ cmpl(FieldAddress(temp, Field::is_nullable_offset()),
             Immediate(kNullCid));
     __ j(EQUAL, &store_pointer);
+    __ movzxb(temp2, FieldAddress(temp, Field::kind_bits_offset()));
+    __ testl(temp2, Immediate(1 << Field::kUnboxingCandidateBit));
+    __ j(ZERO, &store_pointer);
 
     const Immediate& raw_null =
         Immediate(reinterpret_cast<intptr_t>(Object::null()));
     __ movl(temp, FieldAddress(instance_reg, field().Offset()));
     __ cmpl(temp, raw_null);
     __ j(NOT_EQUAL, &copy_payload);
 
     StoreInstanceFieldSlowPath* slow_path =
         new StoreInstanceFieldSlowPath(this);
     compiler->AddSlowPathCode(slow_path);
@@ skipping 3497 matching lines @@
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #undef __
 
 #endif  // defined TARGET_ARCH_IA32