Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/nodes.dart

Index: lib/compiler/implementation/ssa/nodes.dart
diff --git a/lib/compiler/implementation/ssa/nodes.dart b/lib/compiler/implementation/ssa/nodes.dart
index 52fc8ea178e86e06452d53d907fd6402e1670f89..2ff6033295bda2b2d339f8e4152aca03f34d7614 100644
--- a/lib/compiler/implementation/ssa/nodes.dart
+++ b/lib/compiler/implementation/ssa/nodes.dart
@@ -1067,8 +1067,10 @@ class HCheck extends HInstruction {
 }
 
 class HTypeGuard extends HInstruction {
-  int state;
-  HTypeGuard(int this.state, List<HInstruction> env) : super(env);
+  final int state;
+  final HType guardedType;
+  bool isActive = false;

[ngeoffray, 2012/04/18 12:05:09]

Not sure, but for me isOn conveys more what this is doing.

[floitsch, 2012/04/18 17:18:46]

Done.

+  HTypeGuard(this.guardedType, this.state, List<HInstruction> env) : super(env);
 
   void prepareGvn() {
     assert(!hasSideEffects());
@@ -1077,12 +1079,19 @@ class HTypeGuard extends HInstruction {
 
   HInstruction get guarded() => inputs.last();
 
+  HType computeTypeFromInputTypes() {
+    if (isActive) return guardedType;

[kasperl, 2012/04/18 11:46:15]

return isActive ? guardedType : guarded.propagatedType;

[floitsch, 2012/04/18 17:18:46]

Done.

+    return guarded.propagatedType;
+  }
+
+  HType get guaranteedType() => isActive ? guardedType : HType.UNKNOWN;
+
   bool isControlFlow() => true;
 
   accept(HVisitor visitor) => visitor.visitTypeGuard(this);
   int typeCode() => 1;
   bool typeEquals(other) => other is HTypeGuard;
-  bool dataEquals(HTypeGuard other) => propagatedType == other.propagatedType;
+  bool dataEquals(HTypeGuard other) => guardedType == other.guardedType;
 }
 
 class HBoundsCheck extends HCheck {
@@ -1418,6 +1427,14 @@ class HBinaryArithmetic extends HInvokeBinary {
     if (propagatedType.isUnknown() || propagatedType.isNumber()) {
       return HType.NUMBER;
     }
+    // Even if the desired outgoing type is not a number we still want the
+    // second argument to be a number if the first one is a number. This will
+    // not help for the outgoing type, but at least the binary arithmetic
+    // operation will not have type problems.
+    // TODO(floitsch): normally we shouldn't request a number, but simply
+    // throw an IllegalArgumentException if it isn't. This would be similar
+    // to the array case.
+    if (input == right && left.isNumber()) return HType.NUMBER;
     return HType.UNKNOWN;
   }