Make typing-asm match spec more closely around load/store, add more tests.

src/type-cache.h

Index: src/type-cache.h
diff --git a/src/type-cache.h b/src/type-cache.h
index aacd449aa1515b775fab50b3ba5199780810cc2e..1b3a26033bb7676e0cfb640e0ea3a258acb41a01 100644
--- a/src/type-cache.h
+++ b/src/type-cache.h
@@ -58,6 +58,9 @@ class TypeCache final {
   Type* const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
   Type* const kPositiveSafeInteger = CreateRange(0.0, kMaxSafeInteger);
 
+  Type* const kUntaggedUndefined =
+      Type::Intersect(Type::Undefined(), Type::Untagged(), zone());
+
   // Asm.js related types.
   Type* const kAsmSigned = kInt32;
   Type* const kAsmUnsigned = kUint32;
@@ -65,6 +68,12 @@ class TypeCache final {
   Type* const kAsmFixnum = Type::Intersect(kAsmSigned, kAsmUnsigned, zone());
   Type* const kAsmFloat = kFloat32;
   Type* const kAsmDouble = kFloat64;
+  Type* const kAsmFloatQ = Type::Union(kAsmFloat, kUntaggedUndefined, zone());
+  Type* const kAsmDoubleQ = Type::Union(kAsmDouble, kUntaggedUndefined, zone());
+  // Not part of the Asm.js type hierarchy, but represents a part of what
+  // intish encompasses.
+  Type* const kAsmIntQ = Type::Union(kAsmInt, kUntaggedUndefined, zone());
+  Type* const kAsmFloatDoubleQ = Type::Union(kAsmFloatQ, kAsmDoubleQ, zone());
   // Asm.js size unions.
   Type* const kAsmSize8 = Type::Union(kInt8, kUint8, zone());
   Type* const kAsmSize16 = Type::Union(kInt16, kUint16, zone());
@@ -77,6 +86,11 @@ class TypeCache final {
       Type::Union(kAsmUnsigned, Type::Union(kAsmDouble, kAsmFloat, zone()),
                   zone()),
       zone());
+  Type* const kAsmIntArrayElement =
+      Type::Union(Type::Union(kInt8, kUint8, zone()),
+                  Type::Union(Type::Union(kInt16, kUint16, zone()),
+                              Type::Union(kInt32, kUint32, zone()), zone()),
+                  zone());
 
   // The FixedArray::length property always containts a smi in the range
   // [0, FixedArray::kMaxLength].