Fix assertion in JSLoadContext typer.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
@@ skipping 475 matching lines @@
 
 Bounds Typer::Visitor::TypeJSInstanceOf(Node* node) {
   return Bounds(Type::Boolean(zone()));
 }
 
 
 // JS context operators.
 
 Bounds Typer::Visitor::TypeJSLoadContext(Node* node) {
   Bounds outer = OperandType(node, 0);
-  DCHECK(outer.upper->Is(Type::Internal()));
-  DCHECK(outer.lower->Equals(outer.upper));
+  DCHECK(outer.upper->Maybe(Type::Internal()));
+  // TODO(rossberg): More precisely, instead of the above assertion, we should
+  // back-propagate the constraint that it has to be a subtype of Internal.
+
   ContextAccess access = OpParameter<ContextAccess>(node);
   Type* context_type = outer.upper;
   MaybeHandle<Context> context;
   if (context_type->IsConstant()) {
     context = Handle<Context>::cast(context_type->AsConstant()->Value());
   }
   // Walk context chain (as far as known), mirroring dynamic lookup.
   // Since contexts are mutable, the information is only useful as a lower
   // bound.
   // TODO(rossberg): Could use scope info to fix upper bounds for constant
@@ skipping 338 matching lines @@
 }
 
 
 void Typer::DecorateGraph(Graph* graph) {
   graph->AddDecorator(new (zone()) TyperDecorator(this));
 }
 
 }
 }
 }  // namespace v8::internal::compiler