Fix type check elimination bug in code generator (issue 11792).

runtime/vm/flow_graph_compiler_mips.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_MIPS.
 #if defined(TARGET_ARCH_MIPS)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "lib/error.h"
@@ skipping 646 matching lines @@
   // Preserve instantiator and its type arguments.
   __ addiu(SP, SP, Immediate(-2 * kWordSize));
   __ sw(A2, Address(SP, 1 * kWordSize));
 
   // A null object is always assignable and is returned as result.
   Label is_assignable, runtime_call;
 
   __ BranchEqual(A0, reinterpret_cast<int32_t>(Object::null()), &is_assignable);
   __ delay_slot()->sw(A1, Address(SP, 0 * kWordSize));
 
-  if (!FLAG_eliminate_type_checks) {
+  if (!FLAG_eliminate_type_checks || dst_type.IsMalformed()) {
     // If type checks are not eliminated during the graph building then
     // a transition sentinel can be seen here.
     __ BranchEqual(A0, Object::transition_sentinel(), &is_assignable);
   }
 
   // Generate throw new TypeError() if the type is malformed.
   if (dst_type.IsMalformed()) {
     const Error& error = Error::Handle(dst_type.malformed_error());
     const String& error_message = String::ZoneHandle(
         Symbols::New(error.ToErrorCString()));
@@ skipping 1323 matching lines @@
   __ AddImmediate(SP, kDoubleSize);
 }
 
 
 #undef __
 
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_MIPS