Fix off-by-one error in AstTyper.

test/mjsunit/regress/regress-param-local-type.js

Index: test/mjsunit/regress/regress-param-local-type.js
diff --git a/test/mjsunit/compiler/increment-typefeedback.js b/test/mjsunit/regress/regress-param-local-type.js
similarity index 86%
copy from test/mjsunit/compiler/increment-typefeedback.js
copy to test/mjsunit/regress/regress-param-local-type.js
index 798959296c43014f252d65ae5dd11e00563bfd04..ed688a90f33ca5f0449a013f16a10ec990c2df3d 100644
--- a/test/mjsunit/compiler/increment-typefeedback.js
+++ b/test/mjsunit/regress/regress-param-local-type.js
@@ -27,13 +27,18 @@
 
 // Flags: --allow-natives-syntax
 
-function f(x) {
-  x++;
-  return x;
+// Test that we do not confuse the first local and the first parameter
+// when gathering type information.
+
+function f(a) {  // First parameter is tagged.
+  var s = '';    // First local has string type.
+  var n = 0;
+  var i = 1;
+  n = i + a;
 }
 
-f(0.5);
-f(0.5);
+f(1);
+f(1);
 %OptimizeFunctionOnNextCall(f);
-f(0.5);
+f(1);
 assertOptimized(f);