Make typing-asm match spec more closely around load/store, add more tests.

src/type-cache.h

Index: src/type-cache.h
diff --git a/src/type-cache.h b/src/type-cache.h
index 512d9b9a2648d5771b82f0e4d60810007a95762a..3d70eb510a2810d581c9ef95a3c836cdcde63df9 100644
--- a/src/type-cache.h
+++ b/src/type-cache.h
@@ -54,6 +54,9 @@ class TypeCache final {
 
   Type* const kPositiveSafeInteger = CreateRange(0.0, kMaxSafeInteger);
 
+  Type* const kUntaggedUndefined =
+      Type::Intersect(Type::Undefined(), Type::Untagged(), zone());
+
   // Asm.js related types.
   Type* const kAsmSigned = kInt32;
   Type* const kAsmUnsigned = kUint32;
@@ -61,6 +64,12 @@ class TypeCache final {
   Type* const kAsmFixnum = Type::Intersect(kAsmSigned, kAsmUnsigned, zone());
   Type* const kAsmFloat = kFloat32;
   Type* const kAsmDouble = kFloat64;
+  Type* const kAsmFloatQ = Type::Union(kAsmFloat, kUntaggedUndefined, zone());
+  Type* const kAsmDoubleQ = Type::Union(kAsmDouble, kUntaggedUndefined, zone());
+  // Not part of the Asm.js type hierarchy, but represents a part of what
+  // intish encompasses.
+  Type* const kAsmIntQ = Type::Union(kAsmInt, kUntaggedUndefined, zone());
+  Type* const kAsmFloatDoubleQ = Type::Union(kAsmFloatQ, kAsmDoubleQ, zone());
   // Asm.js size unions.
   Type* const kAsmSize8 = Type::Union(kInt8, kUint8, zone());
   Type* const kAsmSize16 = Type::Union(kInt16, kUint16, zone());
@@ -73,6 +82,11 @@ class TypeCache final {
       Type::Union(kAsmUnsigned, Type::Union(kAsmDouble, kAsmFloat, zone()),
                   zone()),
       zone());
+  Type* const kAsmIntArrayElement =
+      Type::Union(Type::Union(kInt8, kUint8, zone()),
+                  Type::Union(Type::Union(kInt16, kUint16, zone()),
+                              Type::Union(kInt32, kUint32, zone()), zone()),
+                  zone());
 
   // The FixedArray::length property always containts a smi in the range
   // [0, FixedArray::kMaxLength].