Fix assertion in JSLoadContext typer.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/531533003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23557 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/typer.cc

@@ -493,8 +493,10 @@ Bounds Typer::Visitor::TypeJSInstanceOf(Node* node) {
 
 Bounds Typer::Visitor::TypeJSLoadContext(Node* node) {
   Bounds outer = OperandType(node, 0);
-  DCHECK(outer.upper->Is(Type::Internal()));
-  DCHECK(outer.lower->Equals(outer.upper));
+  DCHECK(outer.upper->Maybe(Type::Internal()));
+  // TODO(rossberg): More precisely, instead of the above assertion, we should
+  // back-propagate the constraint that it has to be a subtype of Internal.
+
   ContextAccess access = OpParameter<ContextAccess>(node);
   Type* context_type = outer.upper;
   MaybeHandle<Context> context;