Fix a bug in typecasts in the VM.

runtime/vm/flow_graph_builder.cc

Index: runtime/vm/flow_graph_builder.cc
diff --git a/runtime/vm/flow_graph_builder.cc b/runtime/vm/flow_graph_builder.cc
index 53e039480e39b0f24e278b84f150b4d78baa56ca..f7c527e6bac8fa28348c8ff2a25f16932b1249e0 100644
--- a/runtime/vm/flow_graph_builder.cc
+++ b/runtime/vm/flow_graph_builder.cc
@@ -930,7 +930,8 @@ void EffectGraphVisitor::VisitAssignableNode(AssignableNode* node) {
                        for_value.value(),
                        node->type(),
                        node->dst_name())) {
-    checked_value = for_value.value()->definition();  // No check needed.
+    // Drop the value and 0 additional temporaries.
+    checked_value = new DropTempsInstr(0, for_value.value());
   } else {
     checked_value = BuildAssertAssignable(node->expr()->token_pos(),
                                           for_value.value(),
@@ -1301,12 +1302,17 @@ void EffectGraphVisitor::BuildTypeCast(ComparisonNode* node) {
   ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded());
   ValueGraphVisitor for_value(owner(), temp_index());
   node->left()->Visit(&for_value);
+  Append(for_value);
   const String& dst_name = String::ZoneHandle(
       Symbols::New(Exceptions::kCastErrorDstName));
-  if (!CanSkipTypeCheck(node->token_pos(), for_value.value(), type, dst_name)) {
-    Append(for_value);
-    Do(BuildAssertAssignable(
-        node->token_pos(), for_value.value(), type, dst_name));
+  if (CanSkipTypeCheck(node->token_pos(), for_value.value(), type, dst_name)) {
+    // Drop the value and 0 additional temporaries.
+    Do(new DropTempsInstr(0, for_value.value()));
+  } else {
+    Do(BuildAssertAssignable(node->token_pos(),
+                             for_value.value(),
+                             type,
+                             dst_name));
   }
 }