Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/nodes.dart

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 interface HVisitor<R> {
   R visitAdd(HAdd node);
   R visitBitAnd(HBitAnd node);
   R visitBitNot(HBitNot node);
   R visitBitOr(HBitOr node);
   R visitBitXor(HBitXor node);
@@ skipping 891 matching lines @@
    *
    * Note that the [propagatedType] may only be set to [HType.CONFLICTING] with
    * speculative types (as otherwise the instruction either sets the output
    * type to [HType.UNKNOWN] or a specific type.
    */
   HType propagatedType = HType.UNKNOWN;
 
   /**
    * Some instructions have a good idea of their return type, but cannot
    * guarantee the type. The [likelyType] does not need to be more specialized
-   * than the [propagatedType]. 
+   * than the [propagatedType].
    *
    * Examples: the [likelyType] of [:x == y:] is a boolean. In most cases this
    * cannot be guaranteed, but when merging types we still want to use this
    * information.
    *
    * Similarily the [HAdd] instruction is likely a number. Note that, even if
    * the [propagatedType] is already set to integer, the [likelyType] still
-   * might just return the number type. 
-   */ 
+   * might just return the number type.
+   */
   HType get likelyType() => propagatedType;
 
   /**
    * Compute the type of the instruction by propagating the input types through
    * the instruction.
    *
    * By default just copy the guaranteed type.
    */
   HType computeTypeFromInputTypes() => guaranteedType;
 
@@ skipping 128 matching lines @@
 class HCheck extends HInstruction {
   HCheck(inputs) : super(inputs);
 
   // TODO(floitsch): make class abstract instead of adding an abstract method.
   abstract accept(HVisitor visitor);
 
   bool isControlFlow() => true;
 }
 
 class HTypeGuard extends HInstruction {
-  int state;
-  HTypeGuard(int this.state, List<HInstruction> env) : super(env);
+  final int state;
+  final HType guardedType;
+  bool isOn = false;
+  HTypeGuard(this.guardedType, this.state, List<HInstruction> env) : super(env);
 
   void prepareGvn() {
     assert(!hasSideEffects());
     setUseGvn();
   }
 
   HInstruction get guarded() => inputs.last();
 
+  HType computeTypeFromInputTypes() {
+    return isOn ? guardedType : guarded.propagatedType;
+  }
+
+  HType get guaranteedType() => isOn ? guardedType : HType.UNKNOWN;
+
   bool isControlFlow() => true;
 
   accept(HVisitor visitor) => visitor.visitTypeGuard(this);
   int typeCode() => 1;
   bool typeEquals(other) => other is HTypeGuard;
-  bool dataEquals(HTypeGuard other) => propagatedType == other.propagatedType;
+  bool dataEquals(HTypeGuard other) => guardedType == other.guardedType;
 }
 
 class HBoundsCheck extends HCheck {
   HBoundsCheck(length, index) : super(<HInstruction>[length, index]);
 
   HInstruction get length() => inputs[0];
   HInstruction get index() => inputs[1];
 
   void prepareGvn() {
     assert(!hasSideEffects());
@@ skipping 315 matching lines @@
   HType computeDesiredTypeForNonTargetInput(HInstruction input) {
     // If the desired output type should be an integer we want to get two
     // integers as arguments.
     if (propagatedType.isInteger()) return HType.INTEGER;
     // If the outgoing type should be a number we can get that if both inputs
     // are numbers. If we don't know the outgoing type we try to make it a
     // number.
     if (propagatedType.isUnknown() || propagatedType.isNumber()) {
       return HType.NUMBER;
     }
+    // Even if the desired outgoing type is not a number we still want the
+    // second argument to be a number if the first one is a number. This will
+    // not help for the outgoing type, but at least the binary arithmetic
+    // operation will not have type problems.
+    // TODO(floitsch): normally we shouldn't request a number, but simply
+    // throw an IllegalArgumentException if it isn't. This would be similar
+    // to the array case.
+    if (input == right && left.isNumber()) return HType.NUMBER;
     return HType.UNKNOWN;
   }
 
   HType get likelyType() {
     if (left.isTypeUnknown()) return HType.NUMBER;
     return HType.UNKNOWN;
   }
 
   // TODO(1603): The class should be marked as abstract.
   abstract BinaryOperation get operation();
@@ skipping 569 matching lines @@
 
   HType computeDesiredTypeForNonTargetInput(HInstruction input) {
     if (input == left && right.propagatedType.isUseful()) {
       // All our useful types have === semantics. But we don't want to
       // speculatively test for all possible types. Therefore we try to match
       // the two types. That is, if we see x == 3, then we speculatively test
       // if x is a number and bailout if it isn't.
       if (right.isNumber()) return HType.NUMBER;  // No need to be more precise.
       // String equality testing is much more common than array equality
       // testing.
-      if (right.isStringOrArray()) return HType.STRING; 
+      if (right.isStringOrArray()) return HType.STRING;
       return right.propagatedType;
     }
     // String equality testing is much more common than array equality testing.
     if (input == left && left.isStringOrArray()) {
       return HType.READABLE_ARRAY;
     }
     // String equality testing is much more common than array equality testing.
     if (input == right && right.isStringOrArray()) {
       return HType.STRING;
     }
@@ skipping 205 matching lines @@
 class HIfBlockInformation {
   final HIf branch;
   final SubGraph thenGraph;
   final SubGraph elseGraph;
   final HBasicBlock joinBlock;
   HIfBlockInformation(this.branch,
                       this.thenGraph,
                       this.elseGraph,
                       this.joinBlock);
 }