Fix bug in double unboxing.

runtime/vm/intermediate_language_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intermediate_language.h"
 
 #include "vm/dart_entry.h"
@@ skipping 1567 matching lines @@
     FpuRegister fpu_temp = locs()->temp(2).fpu_reg();
 
     Label store_pointer, copy_payload;
     __ LoadObject(temp, Field::ZoneHandle(field().raw()), PP);
     __ cmpq(FieldAddress(temp, Field::guarded_cid_offset()),
             Immediate(kDoubleCid));
     __ j(NOT_EQUAL, &store_pointer);
     __ cmpq(FieldAddress(temp, Field::is_nullable_offset()),
             Immediate(kNullCid));
     __ j(EQUAL, &store_pointer);
+    __ movzxb(temp2, FieldAddress(temp, Field::kind_bits_offset()));
+    __ testq(temp2, Immediate(1 << Field::kUnboxingCandidateBit));
+    __ j(ZERO, &store_pointer);
 
     __ movq(temp, FieldAddress(instance_reg, field().Offset()));
     __ CompareObject(temp, Object::null_object(), PP);
     __ j(NOT_EQUAL, &copy_payload);
 
     StoreInstanceFieldSlowPath* slow_path =
         new StoreInstanceFieldSlowPath(this);
     compiler->AddSlowPathCode(slow_path);
 
     if (!compiler->is_optimizing()) {
@@ skipping 3338 matching lines @@
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #undef __
 
 #endif  // defined TARGET_ARCH_X64