Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/types.dart

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class SsaTypePropagator extends HGraphVisitor implements OptimizationPhase {
 
   final Map<int, HInstruction> workmap;
   final List<int> worklist;
   final Compiler compiler;
   String get name() => 'type propagator';
 
   SsaTypePropagator(Compiler this.compiler)
       : workmap = new Map<int, HInstruction>(),
         worklist = new List<int>();
 
 
   HType computeType(HInstruction instruction) {
     return instruction.computeTypeFromInputTypes();
   }
 
   // Re-compute and update the type of the instruction. Returns
   // whether or not the type was changed.
   bool updateType(HInstruction instruction) {
-    if (instruction.propagatedType.isConflicting()) return false;
-
     HType oldType = instruction.propagatedType;
     HType newType = instruction.hasGuaranteedType()
                     ? instruction.guaranteedType
                     : computeType(instruction);
-    instruction.propagatedType = oldType.combine(newType);
-    return oldType !== instruction.propagatedType;
+    // We unconditionally replace the propagated type with the new type. The
+    // computeType must make sure that we eventually reach a stable state.
+    instruction.propagatedType = newType;
+    return oldType !== newType;
   }
 
   void visitGraph(HGraph graph) {
     visitDominatorTree(graph);
     processWorklist();
   }
 
   visitBasicBlock(HBasicBlock block) {
     if (block.isLoopHeader()) {
       block.forEachPhi((HPhi phi) {
@@ skipping 70 matching lines @@
     for (final user in instruction.usedBy) {
       desiredType =
           desiredType.combine(user.computeDesiredTypeForInput(instruction));
       // No need to continue if two users disagree on the type.
       if (desiredType.isConflicting()) break;
     }
     return desiredType;
   }
 
   HType computeType(HInstruction instruction) {
+    // Once we are in a conflicting state don't update the type anymore.
+    if (instruction.propagatedType.isConflicting()) {

[kasperl, 2012/04/18 11:46:15]

Cache instruction.propagatedType in a local variable?

[floitsch, 2012/04/18 17:18:46]

Done.

+      return instruction.propagatedType;
+    }
+
     HType newType = super.computeType(instruction);
     // [computeDesiredType] goes to all usedBys and lets them compute their
     // desired type. By setting the [newType] here we give them more context to
     // work with. 
     instruction.propagatedType = newType;
     HType desiredType = computeDesiredType(instruction);
     // If the desired type is conflicting just return the computed type.
     if (desiredType.isConflicting()) return newType;
     return newType.combine(desiredType);
   }
 }