Fix bug in static type inference for loops.

src/ia32/virtual-frame-ia32.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 202 matching lines @@
               __ mov(fresh.reg(), backing_element.reg());
             }
           } else {
             ASSERT(backing_element.is_memory());
             __ mov(fresh.reg(), Operand(ebp, fp_relative(element.index())));
           }
         }
       }
       // No need to set the copied flag---there are no copies of
       // copies or constants so the original was not copied.
-      elements_[i].set_static_type(element.static_type());
+
+      // Backwards jump targets can never know the type of a value.
+      elements_[i].set_static_type(StaticType::unknown());
     } else {
       // Clear the copy flag of non-constant, non-copy elements above
       // the high water mark.  They cannot be copied because copes are
       // always higher than their backing store and copies are not
       // allowed above the water mark.
       elements_[i].clear_copied();
     }
   }
 }
 
@@ skipping 845 matching lines @@
   ASSERT(stack_pointer_ == element_count() - 1);
   elements_.Add(FrameElement::MemoryElement());
   stack_pointer_++;
   __ push(immediate);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal