Fix type check elimination bug in code generator (issue 11792).

runtime/vm/flow_graph_compiler_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_IA32.
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "lib/error.h"
@@ skipping 656 matching lines @@
          (!dst_type.IsDynamicType() && !dst_type.IsObjectType()));
   __ pushl(ECX);  // Store instantiator.
   __ pushl(EDX);  // Store instantiator type arguments.
   // A null object is always assignable and is returned as result.
   const Immediate& raw_null =
       Immediate(reinterpret_cast<intptr_t>(Object::null()));
   Label is_assignable, runtime_call;
   __ cmpl(EAX, raw_null);
   __ j(EQUAL, &is_assignable);
 
-  if (!FLAG_eliminate_type_checks) {
+  if (!FLAG_eliminate_type_checks || dst_type.IsMalformed()) {
     // If type checks are not eliminated during the graph building then
     // a transition sentinel can be seen here.
     const Immediate& raw_transition_sentinel =
         Immediate(reinterpret_cast<intptr_t>(
             Object::transition_sentinel().raw()));
     __ cmpl(EAX, raw_transition_sentinel);
     __ j(EQUAL, &is_assignable);
   }
 
   // Generate throw new TypeError() if the type is malformed.
@@ skipping 1222 matching lines @@
   __ movups(reg, Address(ESP, 0));
   __ addl(ESP, Immediate(kFpuRegisterSize));
 }
 
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32