Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/bailout.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class BailoutInfo {
   int instructionId;
   int bailoutId;
   BailoutInfo(this.instructionId, this.bailoutId);
 }
 
@@ skipping 268 matching lines @@
     HType propagatedType = instruction.propagatedType;
     return propagatedType.isUseful()
         && propagatedType != instruction.computeTypeFromInputTypes();
   }
 
   void insertCapturedEnvironments() {
     work.guards = <HTypeGuard>[];
     int state = 1;
     capturedEnvironments.forEach((HInstruction instruction, Environment env) {
       List<HInstruction> inputs = env.buildAndSetLast(instruction);
-      HTypeGuard guard = new HTypeGuard(state++, inputs);
+      HTypeGuard guard =
+          new HTypeGuard(instruction.propagatedType, state++, inputs);
       work.guards.add(guard);
       instruction.block.rewrite(instruction, guard);
       HInstruction insertionPoint = (instruction is HPhi)
           ? instruction.block.first
           : instruction.next;
       insertionPoint.block.addBefore(insertionPoint, guard);
     });
   }
 }
 
@@ skipping 61 matching lines @@
     compiler.internalError('Control flow instructions already dealt with.',
                            instruction: instruction);
   }
 
   visitTypeGuard(HTypeGuard guard) {
     blocks.forEach((HBasicBlock block) {
       block.guards.add(guard);
     });
   }
 }