Fix a bug in typecasts in the VM.

runtime/vm/flow_graph_builder.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_builder.h"
 
 #include "lib/invocation_mirror.h"
 #include "vm/ast_printer.h"
 #include "vm/bit_vector.h"
 #include "vm/code_descriptors.h"
@@ skipping 912 matching lines @@
 //                              dst_name: String }
 void EffectGraphVisitor::VisitAssignableNode(AssignableNode* node) {
   ValueGraphVisitor for_value(owner(), temp_index());
   node->expr()->Visit(&for_value);
   Append(for_value);
   Definition* checked_value;
   if (CanSkipTypeCheck(node->expr()->token_pos(),
                        for_value.value(),
                        node->type(),
                        node->dst_name())) {
-    checked_value = for_value.value()->definition();  // No check needed.
+    // Drop the value and 0 additional temporaries.
+    checked_value = new DropTempsInstr(0, for_value.value());
   } else {
     checked_value = BuildAssertAssignable(node->expr()->token_pos(),
                                           for_value.value(),
                                           node->type(),
                                           node->dst_name());
   }
   ReturnDefinition(checked_value);
 }
 
 
@@ skipping 350 matching lines @@
   ReturnDefinition(call);
 }
 
 
 void EffectGraphVisitor::BuildTypeCast(ComparisonNode* node) {
   ASSERT(Token::IsTypeCastOperator(node->kind()));
   const AbstractType& type = node->right()->AsTypeNode()->type();
   ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded());
   ValueGraphVisitor for_value(owner(), temp_index());
   node->left()->Visit(&for_value);
+  Append(for_value);
   const String& dst_name = String::ZoneHandle(
       Symbols::New(Exceptions::kCastErrorDstName));
-  if (!CanSkipTypeCheck(node->token_pos(), for_value.value(), type, dst_name)) {
-    Append(for_value);
-    Do(BuildAssertAssignable(
-        node->token_pos(), for_value.value(), type, dst_name));
+  if (CanSkipTypeCheck(node->token_pos(), for_value.value(), type, dst_name)) {
+    // Drop the value and 0 additional temporaries.
+    Do(new DropTempsInstr(0, for_value.value()));
+  } else {
+    Do(BuildAssertAssignable(node->token_pos(),
+                             for_value.value(),
+                             type,
+                             dst_name));
   }
 }
 
 
 void ValueGraphVisitor::BuildTypeCast(ComparisonNode* node) {
   ASSERT(Token::IsTypeCastOperator(node->kind()));
   ASSERT(!node->right()->AsTypeNode()->type().IsNull());
   const AbstractType& type = node->right()->AsTypeNode()->type();
   ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded());
   ValueGraphVisitor for_value(owner(), temp_index());
@@ skipping 2530 matching lines @@
   intptr_t len = OS::SNPrint(NULL, 0, kFormat, function_name, reason) + 1;
   char* chars = Isolate::Current()->current_zone()->Alloc<char>(len);
   OS::SNPrint(chars, len, kFormat, function_name, reason);
   const Error& error = Error::Handle(
       LanguageError::New(String::Handle(String::New(chars))));
   Isolate::Current()->long_jump_base()->Jump(1, error);
 }
 
 
 }  // namespace dart