Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/optimize.dart

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 interface OptimizationPhase {
   String get name();
   void visitGraph(HGraph graph);
 }
 
 class SsaOptimizerTask extends CompilerTask {
@@ skipping 17 matching lines @@
           new SsaDeadPhiEliminator(),
           new SsaGlobalValueNumberer(compiler),
           new SsaCodeMotion(),
           new SsaDeadCodeEliminator()];
       runPhases(graph, phases);
     });
   }
 
   bool trySpeculativeOptimizations(WorkItem work, HGraph graph) {
     return measure(() {
-      // Run the phases that will generate type guards. We must also run
-      // [SsaCheckInserter] because the type propagator also propagates
-      // types non-speculatively. For example, it propagates the type
-      // array for a call to the List constructor.
+      // Run the phases that will generate type guards.
       List<OptimizationPhase> phases = <OptimizationPhase>[
           new SsaSpeculativeTypePropagator(compiler),
           new SsaTypeGuardBuilder(compiler, work),
+          // Change the propagated types back to what they were before we
+          // speculatively propagated, so that we can generate the bailout
+          // version.
+          // Note that we do this even if there were no guards inserted. If a
+          // guard is not beneficial enough we don't emit one, but there might
+          // still be speculative types on the instructions.
+          new SsaTypePropagator(compiler),
+          // Then run the [SsaCheckInserter] because the type propagator also
+          // propagated types non-speculatively. For example, it might have
+          // propagated the type array for a call to the List constructor.
           new SsaCheckInserter(compiler)];
       runPhases(graph, phases);
       return !work.guards.isEmpty();
     });
   }
 
   void prepareForSpeculativeOptimizations(WorkItem work, HGraph graph) {
     measure(() {
       // In order to generate correct code for the bailout version, we did not
       // propagate types from the instruction to the type guard. We do it
       // now to be able to optimize further.
-      work.guards.forEach((HTypeGuard guard) {
-        guard.propagatedType = guard.guarded.propagatedType;
-        guard.guarded.propagatedType = HType.UNKNOWN;
-      });
+      work.guards.forEach((HTypeGuard guard) { guard.isOn = true; });
       // We also need to insert range and integer checks for the type guards,
       // now that they know their type. We did not need to do that
       // before because instructions that reference a guard would
       // have not tried to use, e.g. native array access, since the
       // guard was not typed.
       runPhases(graph, <OptimizationPhase>[new SsaCheckInserter(compiler)]);
     });
   }
 }
 
@@ skipping 642 matching lines @@
         }
       }
       if (!canBeMoved) continue;
 
       // This is safe because we are running after GVN.
       // TODO(ngeoffray): ensure GVN has been run.
       set_.add(current);
     }
   }
 }