Fix type check elimination bug in code generator (issue 11792).

runtime/vm/flow_graph_compiler_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/flow_graph_compiler.h"
 
 #include "lib/error.h"
@@ skipping 652 matching lines @@
          (!dst_type.IsDynamicType() && !dst_type.IsObjectType()));
   __ pushq(RCX);  // Store instantiator.
   __ pushq(RDX);  // Store instantiator type arguments.
   // A null object is always assignable and is returned as result.
   const Immediate& raw_null =
       Immediate(reinterpret_cast<intptr_t>(Object::null()));
   Label is_assignable, runtime_call;
   __ cmpq(RAX, raw_null);
   __ j(EQUAL, &is_assignable);
 
-  if (!FLAG_eliminate_type_checks) {
+  if (!FLAG_eliminate_type_checks || dst_type.IsMalformed()) {
     // If type checks are not eliminated during the graph building then
     // a transition sentinel can be seen here.
     __ CompareObject(RAX, Object::transition_sentinel());
     __ j(EQUAL, &is_assignable);
   }
 
   // Generate throw new TypeError() if the type is malformed.
   if (dst_type.IsMalformed()) {
     const Error& error = Error::Handle(dst_type.malformed_error());
     const String& error_message = String::ZoneHandle(
@@ skipping 1205 matching lines @@
   __ movups(reg, Address(RSP, 0));
   __ addq(RSP, Immediate(kFpuRegisterSize));
 }
 
 
 #undef __
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_X64