Patch forthcoming.
Created attachment 182458 [details] the patch
This blocks https://bugs.webkit.org/show_bug.cgi?id=106690 because it slightly masks that bug. When trying to come up with a reduced case of that other bug, I couldn't, because the CFA was artificially dumbing itself down so that it became too dumb to make the mistake that that bug fixes. :-/
Landed in http://trac.webkit.org/changeset/139688