Using for/of loop on [].entries() gives StackOverflowError

Tried running closure compiler `v20160911` and `v20160713` with `--new_type_inf` on this snippet, but they both give me a `StackOverflowError`.

``` js
for (const o of [].entries()) {}
```

Error:

```
java.lang.StackOverflowError
at com.google.javascript.rhino.jstype.TemplateTypeMap.checkEquivalenceHelper(TemplateTypeMap.java:241)
at com.google.javascript.rhino.jstype.TemplateTypeMap.checkEquivalenceHelper(TemplateTypeMap.java:221)
at com.google.javascript.rhino.jstype.JSType.checkEquivalenceHelper(JSType.java:667)
at com.google.javascript.rhino.jstype.JSType.isEquivalentTo(JSType.java:606)
at com.google.javascript.rhino.jstype.UnionTypeBuilder.addAlternate(UnionTypeBuilder.java:204)
at com.google.javascript.rhino.jstype.UnionTypeBuilder.addAlternate(UnionTypeBuilder.java:315)
at com.google.javascript.rhino.jstype.UnionType.restrictByNotNullOrUndefined(UnionType.java:259)
at com.google.javascript.rhino.jstype.TemplateTypeMapReplacer.isRecursive(TemplateTypeMapReplacer.java:119)
at com.google.javascript.rhino.jstype.TemplateTypeMapReplacer.caseTemplateType(TemplateTypeMapReplacer.java:95)
at com.google.javascript.rhino.jstype.TemplateTypeMapReplacer.caseTemplateType(TemplateTypeMapReplacer.java:54)
at com.google.javascript.rhino.jstype.TemplateType.visit(TemplateType.java:88)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseUnionType(ModificationVisitor.java:240)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseUnionType(ModificationVisitor.java:56)
at com.google.javascript.rhino.jstype.UnionType.visit(UnionType.java:618)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseTemplatizedType(ModificationVisitor.java:197)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseTemplatizedType(ModificationVisitor.java:56)
at com.google.javascript.rhino.jstype.TemplatizedType.visit(TemplatizedType.java:122)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseUnionType(ModificationVisitor.java:240)
at com.google.javascript.rhino.jstype.ModificationVisitor.caseUnionType(ModificationVisitor.java:56)
at com.google.javascript.rhino.jstype.UnionType.visit(UnionType.java:618)
...
```

Appears to work correctly without the `--new_type_inf` flag.

The web service gives a 500 error: https://closure-compiler.appspot.com/home#code%3D%252F%252F%2520%253D%253DClosureCompiler%253D%253D%250A%252F%252F%2520%2540compilation_level%2520ADVANCED_OPTIMIZATIONS%250A%252F%252F%2520%2540output_file_name%2520default.js%250A%252F%252F%2520%253D%253D%252FClosureCompiler%253D%253D%250A%250Afor%2520(const%2520o%2520of%2520%255B%255D.entries())%2520%257B%257D