Fix bug in double unboxing.

runtime/vm/intermediate_language_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_MIPS.
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/intermediate_language.h"
 
 #include "vm/dart_entry.h"
@@ skipping 1727 matching lines @@
     Register temp = locs()->temp(0).reg();
     Register temp2 = locs()->temp(1).reg();
     DRegister fpu_temp = locs()->temp(2).fpu_reg();
 
     Label store_pointer, copy_payload;
     __ LoadObject(temp, Field::ZoneHandle(field().raw()));
     __ lw(temp2, FieldAddress(temp, Field::guarded_cid_offset()));
     __ BranchNotEqual(temp2, kDoubleCid, &store_pointer);
     __ lw(temp2, FieldAddress(temp, Field::is_nullable_offset()));
     __ BranchEqual(temp2, kNullCid, &store_pointer);
+    __ lbu(temp2, FieldAddress(temp, Field::kind_bits_offset()));
+    __ andi(CMPRES1, temp2, Immediate(1 << Field::kUnboxingCandidateBit));
+    __ beq(CMPRES1, ZR, &store_pointer);
 
     __ lw(temp, FieldAddress(instance_reg, field().Offset()));
     __ BranchNotEqual(temp, reinterpret_cast<int32_t>(Object::null()),
                       &copy_payload);
 
     StoreInstanceFieldSlowPath* slow_path =
         new StoreInstanceFieldSlowPath(this);
     compiler->AddSlowPathCode(slow_path);
 
     if (!compiler->is_optimizing()) {
@@ skipping 2420 matching lines @@
   compiler->GenerateCall(token_pos(),
                          &label,
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS