Fix #23567, a specializer bug
Found by Simon in #23567 (comment 507834)
The testcase isn't ideal because it doesn't detect the bug in master
, unless doNotUnbox
is removed as in #23567 (comment 507834). But I have confirmed that with that modification, it fails before and passes afterwards.