Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/types.dart

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 class SsaTypePropagator extends HGraphVisitor implements OptimizationPhase {
 
   final Map<int, HInstruction> workmap;
   final List<int> worklist;
   final Compiler compiler;
   String get name() => 'type propagator';
 
   SsaTypePropagator(Compiler this.compiler)
       : workmap = new Map<int, HInstruction>(),
         worklist = new List<int>();
 
 
   HType computeType(HInstruction instruction) {
     return instruction.computeTypeFromInputTypes();
   }
 
   // Re-compute and update the type of the instruction. Returns
   // whether or not the type was changed.
   bool updateType(HInstruction instruction) {
-    if (instruction.propagatedType.isConflicting()) return false;
-
     HType oldType = instruction.propagatedType;
     HType newType = instruction.hasGuaranteedType()
                     ? instruction.guaranteedType
                     : computeType(instruction);
-    instruction.propagatedType = oldType.combine(newType);
-    return oldType !== instruction.propagatedType;
+    // We unconditionally replace the propagated type with the new type. The
+    // computeType must make sure that we eventually reach a stable state.
+    instruction.propagatedType = newType;
+    return oldType !== newType;
   }
 
   void visitGraph(HGraph graph) {
     visitDominatorTree(graph);
     processWorklist();
   }
 
   visitBasicBlock(HBasicBlock block) {
     if (block.isLoopHeader()) {
       block.forEachPhi((HPhi phi) {
@@ skipping 29 matching lines @@
         addDependentInstructionsToWorkList(instruction);
       }
     }
   }
 
   void addDependentInstructionsToWorkList(HInstruction instruction) {
     for (int i = 0, length = instruction.usedBy.length; i < length; i++) {
       // The non-speculative type propagator only propagates types forward. We
       // thus only need to add the users of the [instruction] to the list.
       addToWorkList(instruction.usedBy[i]);
-    }    
+    }
   }
 
   void addToWorkList(HInstruction instruction) {
     final int id = instruction.id;
     if (!workmap.containsKey(id)) {
       worklist.add(id);
       workmap[id] = instruction;
     }
   }
 }
 
 class SsaSpeculativeTypePropagator extends SsaTypePropagator {
   final String name = 'speculative type propagator';
   SsaSpeculativeTypePropagator(Compiler compiler) : super(compiler);
 
   void addDependentInstructionsToWorkList(HInstruction instruction) {
     // The speculative type propagator propagates types forward and backward.
     // Not only do we need to add the users of the [instruction] to the list.
     // We also need to add the inputs fo the [instruction], since they might
     // want to propagate the desired outgoing type.
     for (int i = 0, length = instruction.usedBy.length; i < length; i++) {
       addToWorkList(instruction.usedBy[i]);
-    }    
+    }
     for (int i = 0, length = instruction.inputs.length; i < length; i++) {
       addToWorkList(instruction.inputs[i]);
     }
   }
 
   HType computeDesiredType(HInstruction instruction) {
     HType desiredType = HType.UNKNOWN;
     for (final user in instruction.usedBy) {
       desiredType =
           desiredType.combine(user.computeDesiredTypeForInput(instruction));
       // No need to continue if two users disagree on the type.
       if (desiredType.isConflicting()) break;
     }
     return desiredType;
   }
 
   HType computeType(HInstruction instruction) {
+    // Once we are in a conflicting state don't update the type anymore.
+    HType oldType = instruction.propagatedType;
+    if (oldType.isConflicting()) return oldType;
+
     HType newType = super.computeType(instruction);
     // [computeDesiredType] goes to all usedBys and lets them compute their
     // desired type. By setting the [newType] here we give them more context to
-    // work with. 
+    // work with.
     instruction.propagatedType = newType;
     HType desiredType = computeDesiredType(instruction);
     // If the desired type is conflicting just return the computed type.
     if (desiredType.isConflicting()) return newType;
     return newType.combine(desiredType);
   }
 }