Fix type check elimination bug in code generator (issue 11792).

runtime/vm/flow_graph_compiler_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM.
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "lib/error.h"
@@ skipping 638 matching lines @@
   // Assignable check is skipped in FlowGraphBuilder, not here.
   ASSERT(dst_type.IsMalformed() ||
          (!dst_type.IsDynamicType() && !dst_type.IsObjectType()));
   // Preserve instantiator (R2) and its type arguments (R1).
   __ PushList((1 << R1) | (1 << R2));
   // A null object is always assignable and is returned as result.
   Label is_assignable, runtime_call;
   __ CompareImmediate(R0, reinterpret_cast<int32_t>(Object::null()));
   __ b(&is_assignable, EQ);
 
-  if (!FLAG_eliminate_type_checks) {
+  if (!FLAG_eliminate_type_checks || dst_type.IsMalformed()) {
     // If type checks are not eliminated during the graph building then
     // a transition sentinel can be seen here.
     __ CompareObject(R0, Object::transition_sentinel());
     __ b(&is_assignable, EQ);
   }
 
   // Generate throw new TypeError() if the type is malformed.
   if (dst_type.IsMalformed()) {
     const Error& error = Error::Handle(dst_type.malformed_error());
     const String& error_message = String::ZoneHandle(
@@ skipping 1178 matching lines @@
 void ParallelMoveResolver::RestoreFpuScratch(FpuRegister reg) {
   __ vldrd(reg, Address(SP, kDoubleSize, Address::PostIndex));
 }
 
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM