Don't rely on any speculative type in the bailout version.

lib/compiler/implementation/ssa/types.dart

Index: lib/compiler/implementation/ssa/types.dart
diff --git a/lib/compiler/implementation/ssa/types.dart b/lib/compiler/implementation/ssa/types.dart
index d59d7be820f5ecf776d0bf70cafbb84cb06b1376..c8244f3a78a8ccc3ba28c08941f1e170f522b1db 100644
--- a/lib/compiler/implementation/ssa/types.dart
+++ b/lib/compiler/implementation/ssa/types.dart
@@ -21,14 +21,14 @@ class SsaTypePropagator extends HGraphVisitor implements OptimizationPhase {
   // Re-compute and update the type of the instruction. Returns
   // whether or not the type was changed.
   bool updateType(HInstruction instruction) {
-    if (instruction.propagatedType.isConflicting()) return false;
-
     HType oldType = instruction.propagatedType;
     HType newType = instruction.hasGuaranteedType()
                     ? instruction.guaranteedType
                     : computeType(instruction);
-    instruction.propagatedType = oldType.combine(newType);
-    return oldType !== instruction.propagatedType;
+    // We unconditionally replace the propagated type with the new type. The
+    // computeType must make sure that we eventually reach a stable state.
+    instruction.propagatedType = newType;
+    return oldType !== newType;
   }
 
   void visitGraph(HGraph graph) {
@@ -119,6 +119,11 @@ class SsaSpeculativeTypePropagator extends SsaTypePropagator {
   }
 
   HType computeType(HInstruction instruction) {
+    // Once we are in a conflicting state don't update the type anymore.
+    if (instruction.propagatedType.isConflicting()) {

[kasperl, 2012/04/18 11:46:15]

Cache instruction.propagatedType in a local variable?

[floitsch, 2012/04/18 17:18:46]

Done.

+      return instruction.propagatedType;
+    }
+
     HType newType = super.computeType(instruction);
     // [computeDesiredType] goes to all usedBys and lets them compute their
     // desired type. By setting the [newType] here we give them more context to