Accurately type foreign functions, and variables (attempt 2).

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/typing-asm.h"
 
 #include <limits>
 
 #include "src/v8.h"
 
@@ skipping 18 matching lines @@
 
 
 #define RECURSE(call)               \
   do {                              \
     DCHECK(!HasStackOverflow());    \
     call;                           \
     if (HasStackOverflow()) return; \
     if (!valid_) return;            \
   } while (false)
 
-
 AsmTyper::AsmTyper(Isolate* isolate, Zone* zone, Script* script,
                    FunctionLiteral* root)
     : zone_(zone),
       isolate_(isolate),
       script_(script),
       root_(root),
       valid_(true),
       allow_simd_(false),
       property_info_(NULL),
       intish_(0),
       stdlib_types_(zone),
       stdlib_heap_types_(zone),
       stdlib_math_types_(zone),
 #define V(NAME, Name, name, lane_count, lane_type) \
   stdlib_simd_##name##_types_(zone),
       SIMD128_TYPES(V)
 #undef V
           global_variable_type_(HashMap::PointersMatch,
                                 ZoneHashMap::kDefaultHashMapCapacity,
                                 ZoneAllocationPolicy(zone)),
       local_variable_type_(HashMap::PointersMatch,
                            ZoneHashMap::kDefaultHashMapCapacity,
                            ZoneAllocationPolicy(zone)),
       in_function_(false),
       building_function_tables_(false),
+      visiting_exports_(false),
       cache_(TypeCache::Get()) {
   InitializeAstVisitor(isolate);
   InitializeStdlib();
 }
 
 
 bool AsmTyper::Validate() {
   VisitAsmModule(root_);
   return valid_ && !HasStackOverflow();
 }
@@ skipping 53 matching lines @@
     if (decl != NULL) {
       RECURSE(
           VisitWithExpectation(decl->fun(), Type::Any(zone()), "UNREACHABLE"));
       if (!computed_type_->IsFunction()) {
         FAIL(decl->fun(), "function literal expected to be a function");
       }
     }
   }
 
   // Validate exports.
+  visiting_exports_ = true;
   ReturnStatement* stmt = fun->body()->last()->AsReturnStatement();
   if (stmt == nullptr) {
     FAIL(fun->body()->last(), "last statement in module is not a return");
   }
   RECURSE(VisitWithExpectation(stmt->expression(), Type::Object(),
                                "expected object export"));
 }
 
 
 void AsmTyper::VisitVariableDeclaration(VariableDeclaration* decl) {
@@ skipping 23 matching lines @@
 
 void AsmTyper::VisitFunctionAnnotation(FunctionLiteral* fun) {
   // Extract result type.
   ZoneList<Statement*>* body = fun->body();
   Type* result_type = Type::Undefined(zone());
   if (body->length() > 0) {
     ReturnStatement* stmt = body->last()->AsReturnStatement();
     if (stmt != NULL) {
       Literal* literal = stmt->expression()->AsLiteral();
       Type* old_expected = expected_type_;
-      expected_type_ = Type::Any();
+      expected_type_ = Type::Any(zone());
       if (literal) {
         RECURSE(VisitLiteral(literal, true));
       } else {
         RECURSE(VisitExpressionAnnotation(stmt->expression(), NULL, true));
       }
       expected_type_ = old_expected;
       result_type = computed_type_;
     }
   }
-  Type::FunctionType* type =
-      Type::Function(result_type, Type::Any(), fun->parameter_count(), zone())
-          ->AsFunction();
+  Type::FunctionType* type = Type::Function(result_type, Type::Any(zone()),
+                                            fun->parameter_count(), zone())
+                                 ->AsFunction();
 
   // Extract parameter types.
   bool good = true;
   for (int i = 0; i < fun->parameter_count(); ++i) {
     good = false;
     if (i >= body->length()) break;
     ExpressionStatement* stmt = body->at(i)->AsExpressionStatement();
     if (stmt == NULL) break;
     Assignment* expr = stmt->expression()->AsAssignment();
     if (expr == NULL || expr->is_compound()) break;
@@ skipping 54 matching lines @@
           break;
         default:
           break;
       }
     }
     FAIL(expr, "invalid type annotation on binary op");
   }
 
   // Numbers or the undefined literal (for empty returns).
   if (expr->IsLiteral()) {
-    RECURSE(VisitWithExpectation(expr, Type::Any(), "invalid literal"));
+    RECURSE(VisitWithExpectation(expr, Type::Any(zone()), "invalid literal"));
     return;
   }
 
   Call* call = expr->AsCall();
   if (call != NULL) {
     VariableProxy* proxy = call->expression()->AsVariableProxy();
     if (proxy != NULL) {
       VariableInfo* info = GetVariableInfo(proxy->var(), false);
       if (!info ||
           (!info->is_check_function && !info->is_constructor_function)) {
@@ skipping 29 matching lines @@
   }
 }
 
 
 void AsmTyper::VisitBlock(Block* stmt) {
   RECURSE(VisitStatements(stmt->statements()));
 }
 
 
 void AsmTyper::VisitExpressionStatement(ExpressionStatement* stmt) {
-  RECURSE(VisitWithExpectation(stmt->expression(), Type::Any(),
+  RECURSE(VisitWithExpectation(stmt->expression(), Type::Any(zone()),
                                "expression statement expected to be any"));
 }
 
 
 void AsmTyper::VisitEmptyStatement(EmptyStatement* stmt) {}
 
 
 void AsmTyper::VisitSloppyBlockFunctionStatement(
     SloppyBlockFunctionStatement* stmt) {
   Visit(stmt->statement());
@@ skipping 31 matching lines @@
 void AsmTyper::VisitReturnStatement(ReturnStatement* stmt) {
   // Handle module return statement in VisitAsmModule.
   if (!in_function_) {
     return;
   }
   Literal* literal = stmt->expression()->AsLiteral();
   if (literal) {
     VisitLiteral(literal, true);
   } else {
     RECURSE(
-        VisitWithExpectation(stmt->expression(), Type::Any(),
+        VisitWithExpectation(stmt->expression(), Type::Any(zone()),
                              "return expression expected to have return type"));
   }
   if (!computed_type_->Is(return_type_) || !return_type_->Is(computed_type_)) {
     FAIL(stmt->expression(), "return type does not match function signature");
   }
 }
 
 
 void AsmTyper::VisitWithStatement(WithStatement* stmt) {
   FAIL(stmt, "bad with statement");
@@ skipping 101 matching lines @@
   FAIL(stmt, "try statement encountered");
 }
 
 
 void AsmTyper::VisitDebuggerStatement(DebuggerStatement* stmt) {
   FAIL(stmt, "debugger statement encountered");
 }
 
 
 void AsmTyper::VisitFunctionLiteral(FunctionLiteral* expr) {
-  Scope* scope = expr->scope();
-  DCHECK(scope->is_function_scope());
   if (in_function_) {
     FAIL(expr, "invalid nested function");
   }
+  Scope* scope = expr->scope();
+  DCHECK(scope->is_function_scope());
 
   if (!expr->bounds().upper->IsFunction()) {
     FAIL(expr, "invalid function literal");
   }
 
   Type::FunctionType* type = expr->bounds().upper->AsFunction();
   Type* save_return_type = return_type_;
   return_type_ = type->Result();
   in_function_ = true;
   local_variable_type_.Clear();
   RECURSE(VisitDeclarations(scope->declarations()));
   RECURSE(VisitStatements(expr->body()));
   in_function_ = false;
   return_type_ = save_return_type;
   IntersectResult(expr, type);
 }
 
 
 void AsmTyper::VisitNativeFunctionLiteral(NativeFunctionLiteral* expr) {
   FAIL(expr, "function info literal encountered");
 }
 
 
 void AsmTyper::VisitDoExpression(DoExpression* expr) {
   FAIL(expr, "do-expression encountered");
 }
 
 
 void AsmTyper::VisitConditional(Conditional* expr) {
-  RECURSE(VisitWithExpectation(expr->condition(), Type::Number(),
+  if (!in_function_) {
+    FAIL(expr, "ternary operator inside module body");
+  }
+  RECURSE(VisitWithExpectation(expr->condition(), Type::Number(zone()),
                                "condition expected to be integer"));
   if (!computed_type_->Is(cache_.kAsmInt)) {
     FAIL(expr->condition(), "condition must be of type int");
   }
 
   RECURSE(VisitWithExpectation(
       expr->then_expression(), expected_type_,
       "conditional then branch type mismatch with enclosing expression"));
   Type* then_type = StorageType(computed_type_);
   if (intish_ != 0 || !then_type->Is(cache_.kAsmComparable)) {
@@ skipping 10 matching lines @@
 
   if (!then_type->Is(else_type) || !else_type->Is(then_type)) {
     FAIL(expr, "then and else expressions in ? must have the same type");
   }
 
   IntersectResult(expr, then_type);
 }
 
 
 void AsmTyper::VisitVariableProxy(VariableProxy* expr) {
+  VisitVariableProxy(expr, false);
+}
+
+void AsmTyper::VisitVariableProxy(VariableProxy* expr, bool assignment) {
   Variable* var = expr->var();
   VariableInfo* info = GetVariableInfo(var, false);
+  if (!assignment && !in_function_ && !building_function_tables_ &&
+      !visiting_exports_) {
+    if (var->location() != VariableLocation::PARAMETER || var->index() >= 3) {
+      FAIL(expr, "illegal variable reference in module body");
+    }
+  }
   if (info == NULL || info->type == NULL) {
     if (var->mode() == TEMPORARY) {
       SetType(var, Type::Any(zone()));
       info = GetVariableInfo(var, false);
     } else {
       FAIL(expr, "unbound variable");
     }
   }
   if (property_info_ != NULL) {
     SetVariableInfo(var, property_info_);
@@ skipping 66 matching lines @@
 
 void AsmTyper::VisitArrayLiteral(ArrayLiteral* expr) {
   if (in_function_) {
     FAIL(expr, "array literal inside a function");
   }
   // Allowed for function tables.
   ZoneList<Expression*>* values = expr->values();
   Type* elem_type = Type::None(zone());
   for (int i = 0; i < values->length(); ++i) {
     Expression* value = values->at(i);
-    RECURSE(VisitWithExpectation(value, Type::Any(), "UNREACHABLE"));
+    RECURSE(VisitWithExpectation(value, Type::Any(zone()), "UNREACHABLE"));
     if (!computed_type_->IsFunction()) {
       FAIL(value, "array component expected to be a function");
     }
     elem_type = Type::Union(elem_type, computed_type_, zone());
   }
   array_size_ = values->length();
   IntersectResult(expr, Type::Array(elem_type, zone()));
 }
 
 
@@ skipping 12 matching lines @@
   }
   if (expr->is_compound()) FAIL(expr, "compound assignment encountered");
   Type* type = expected_type_;
   RECURSE(VisitWithExpectation(
       expr->value(), type, "assignment value expected to match surrounding"));
   Type* target_type = StorageType(computed_type_);
   if (intish_ != 0) {
     FAIL(expr, "intish or floatish assignment");
   }
   if (expr->target()->IsVariableProxy()) {
-    RECURSE(VisitWithExpectation(expr->target(), target_type,
-                                 "assignment target expected to match value"));
+    expected_type_ = target_type;
+    VisitVariableProxy(expr->target()->AsVariableProxy(), true);
   } else if (expr->target()->IsProperty()) {
     Property* property = expr->target()->AsProperty();
-    RECURSE(VisitWithExpectation(property->obj(), Type::Any(),
+    RECURSE(VisitWithExpectation(property->obj(), Type::Any(zone()),
                                  "bad propety object"));
     if (!computed_type_->IsArray()) {
       FAIL(property->obj(), "array expected");
     }
     VisitHeapAccess(property, true, target_type);
   }
   IntersectResult(expr, target_type);
 }
 
 
@@ skipping 188 matching lines @@
 #undef V
   if (IsStdlibObject(expr->obj())) {
     VisitLibraryAccess(&stdlib_types_, expr);
     return;
   }
 
   property_info_ = NULL;
 
   // Only recurse at this point so that we avoid needing
   // stdlib.Math to have a real type.
-  RECURSE(VisitWithExpectation(expr->obj(), Type::Any(), "bad propety object"));
+  RECURSE(VisitWithExpectation(expr->obj(), Type::Any(zone()),
+                               "bad propety object"));
 
   // For heap view or function table access.
   if (computed_type_->IsArray()) {
     VisitHeapAccess(expr, false, NULL);
     return;
   }
 
   // stdlib.x or foreign.x
   VariableProxy* proxy = expr->obj()->AsVariableProxy();
   if (proxy != NULL) {
     Variable* var = proxy->var();
     if (var->location() == VariableLocation::PARAMETER && var->index() == 1) {
       // foreign.x is ok.
       SetResult(expr, expected_type_);
       return;
     }
   }
 
   FAIL(expr, "invalid property access");
 }
 
 
 void AsmTyper::VisitCall(Call* expr) {
-  RECURSE(VisitWithExpectation(expr->expression(), Type::Any(),
+  Type* expected_type = expected_type_;
+  RECURSE(VisitWithExpectation(expr->expression(), Type::Any(zone()),
                                "callee expected to be any"));
   StandardMember standard_member = kNone;
   VariableProxy* proxy = expr->expression()->AsVariableProxy();
   if (proxy) {
     standard_member = VariableAsStandardMember(proxy->var());
   }
   if (!in_function_ && (proxy == NULL || standard_member != kMathFround)) {
     FAIL(expr, "calls forbidden outside function bodies");
   }
   if (proxy == NULL && !expr->expression()->IsProperty()) {
@@ skipping 34 matching lines @@
         Type* other = Type::Intersect(args->at(0)->bounds().upper,
                                       args->at(1)->bounds().upper, zone());
         if (!other->Is(cache_.kAsmFloat) && !other->Is(cache_.kAsmDouble) &&
             !other->Is(cache_.kAsmSigned)) {
           FAIL(expr, "function arguments types don't match");
         }
       }
     }
     intish_ = 0;
     IntersectResult(expr, result_type);
-  } else if (computed_type_->Is(Type::Any())) {
+  } else if (computed_type_->Is(Type::Any(zone()))) {
     // For foreign calls.
     ZoneList<Expression*>* args = expr->arguments();
     for (int i = 0; i < args->length(); ++i) {
       Expression* arg = args->at(i);
-      RECURSE(VisitWithExpectation(arg, Type::Any(),
+      RECURSE(VisitWithExpectation(arg, Type::Any(zone()),
                                    "foreign call argument expected to be any"));
+      // Checking for asm extern types explicitly, as the type system
+      // doesn't correctly check their inheritance relationship.
+      if (!computed_type_->Is(cache_.kAsmSigned) &&
+          !computed_type_->Is(cache_.kAsmFixnum) &&
+          !computed_type_->Is(cache_.kAsmDouble)) {
+        FAIL(arg,
+             "foreign call argument expected to be int, double, or fixnum");
+      }
     }
     intish_ = kMaxUncombinedAdditiveSteps;
-    IntersectResult(expr, Type::Number());
+    IntersectResult(expr, expected_type);
   } else {
     FAIL(expr, "invalid callee");
   }
 }
 
 
 void AsmTyper::VisitCallNew(CallNew* expr) {
   if (in_function_) {
     FAIL(expr, "new not allowed in module function");
   }
-  RECURSE(VisitWithExpectation(expr->expression(), Type::Any(),
+  RECURSE(VisitWithExpectation(expr->expression(), Type::Any(zone()),
                                "expected stdlib function"));
   if (computed_type_->IsFunction()) {
     Type::FunctionType* fun_type = computed_type_->AsFunction();
     ZoneList<Expression*>* args = expr->arguments();
     if (fun_type->Arity() != args->length())
       FAIL(expr, "call with wrong arity");
     for (int i = 0; i < args->length(); ++i) {
       Expression* arg = args->at(i);
       RECURSE(VisitWithExpectation(
           arg, fun_type->Parameter(i),
           "constructor argument expected to match callee parameter"));
     }
     IntersectResult(expr, fun_type->Result());
     return;
   }
 
   FAIL(expr, "ill-typed new operator");
 }
 
 
 void AsmTyper::VisitCallRuntime(CallRuntime* expr) {
   // Allow runtime calls for now.
 }
 
 
 void AsmTyper::VisitUnaryOperation(UnaryOperation* expr) {
+  if (!in_function_) {
+    FAIL(expr, "unary operator inside module body");
+  }
   switch (expr->op()) {
     case Token::NOT:  // Used to encode != and !==
       RECURSE(VisitWithExpectation(expr->expression(), cache_.kAsmInt,
                                    "operand expected to be integer"));
       IntersectResult(expr, cache_.kAsmSigned);
       return;
     case Token::DELETE:
       FAIL(expr, "delete operator encountered");
     case Token::VOID:
       FAIL(expr, "void operator encountered");
     case Token::TYPEOF:
       FAIL(expr, "typeof operator encountered");
     default:
       UNREACHABLE();
   }
 }
 
 
 void AsmTyper::VisitCountOperation(CountOperation* expr) {
   FAIL(expr, "increment or decrement operator encountered");
 }
 
 
 void AsmTyper::VisitIntegerBitwiseOperator(BinaryOperation* expr,
                                            Type* left_expected,
                                            Type* right_expected,
                                            Type* result_type, bool conversion) {
-  RECURSE(VisitWithExpectation(expr->left(), Type::Number(),
+  RECURSE(VisitWithExpectation(expr->left(), Type::Number(zone()),
                                "left bitwise operand expected to be a number"));
   int left_intish = intish_;
   Type* left_type = computed_type_;
   if (!left_type->Is(left_expected)) {
     FAIL(expr->left(), "left bitwise operand expected to be an integer");
   }
   if (left_intish > kMaxUncombinedAdditiveSteps) {
     FAIL(expr->left(), "too many consecutive additive ops");
   }
 
   RECURSE(
-      VisitWithExpectation(expr->right(), Type::Number(),
+      VisitWithExpectation(expr->right(), Type::Number(zone()),
                            "right bitwise operand expected to be a number"));
   int right_intish = intish_;
   Type* right_type = computed_type_;
   if (!right_type->Is(right_expected)) {
     FAIL(expr->right(), "right bitwise operand expected to be an integer");
   }
   if (right_intish > kMaxUncombinedAdditiveSteps) {
     FAIL(expr->right(), "too many consecutive additive ops");
   }
 
   intish_ = 0;
 
   if (left_type->Is(cache_.kAsmFixnum) && right_type->Is(cache_.kAsmInt)) {
     left_type = right_type;
   }
   if (right_type->Is(cache_.kAsmFixnum) && left_type->Is(cache_.kAsmInt)) {
     right_type = left_type;
   }
   if (!conversion) {
     if (!left_type->Is(right_type) || !right_type->Is(left_type)) {
       FAIL(expr, "ill-typed bitwise operation");
     }
   }
   IntersectResult(expr, result_type);
 }
 
 
 void AsmTyper::VisitBinaryOperation(BinaryOperation* expr) {
+  if (!in_function_) {
+    if (expr->op() != Token::BIT_OR && expr->op() != Token::MUL) {
+      FAIL(expr, "illegal binary operator inside module body");
+    }
+    if (!(expr->left()->IsProperty() || expr->left()->IsVariableProxy()) ||
+        !expr->right()->IsLiteral()) {
+      FAIL(expr, "illegal computation inside module body");
+    }
+  }
   switch (expr->op()) {
     case Token::COMMA: {
-      RECURSE(VisitWithExpectation(expr->left(), Type::Any(),
+      RECURSE(VisitWithExpectation(expr->left(), Type::Any(zone()),
                                    "left comma operand expected to be any"));
-      RECURSE(VisitWithExpectation(expr->right(), Type::Any(),
+      RECURSE(VisitWithExpectation(expr->right(), Type::Any(zone()),
                                    "right comma operand expected to be any"));
       IntersectResult(expr, computed_type_);
       return;
     }
     case Token::OR:
     case Token::AND:
       FAIL(expr, "illegal logical operator");
     case Token::BIT_OR: {
       // BIT_OR allows Any since it is used as a type coercion.
-      VisitIntegerBitwiseOperator(expr, Type::Any(), cache_.kAsmInt,
+      VisitIntegerBitwiseOperator(expr, Type::Any(zone()), cache_.kAsmInt,
                                   cache_.kAsmSigned, true);
+      if (expr->left()->IsCall() && expr->op() == Token::BIT_OR) {
+        IntersectResult(expr->left(), cache_.kAsmSigned);
+      }
       return;
     }
     case Token::BIT_XOR: {
       // Handle booleans specially to handle de-sugared !
       Literal* left = expr->left()->AsLiteral();
       if (left && left->value()->IsBoolean()) {
         if (left->ToBooleanIsTrue()) {
           left->set_bounds(Bounds(cache_.kSingletonOne));
           RECURSE(VisitWithExpectation(expr->right(), cache_.kAsmInt,
                                        "not operator expects an integer"));
           IntersectResult(expr, cache_.kAsmSigned);
           return;
         } else {
           FAIL(left, "unexpected false");
         }
       }
       // BIT_XOR allows Number since it is used as a type coercion (via ~~).
-      VisitIntegerBitwiseOperator(expr, Type::Number(), cache_.kAsmInt,
+      VisitIntegerBitwiseOperator(expr, Type::Number(zone()), cache_.kAsmInt,
                                   cache_.kAsmSigned, true);
       return;
     }
     case Token::SHR: {
       VisitIntegerBitwiseOperator(expr, cache_.kAsmInt, cache_.kAsmInt,
                                   cache_.kAsmUnsigned, false);
       return;
     }
     case Token::SHL:
     case Token::SAR:
     case Token::BIT_AND: {
       VisitIntegerBitwiseOperator(expr, cache_.kAsmInt, cache_.kAsmInt,
                                   cache_.kAsmSigned, false);
       return;
     }
     case Token::ADD:
     case Token::SUB:
     case Token::MUL:
     case Token::DIV:
     case Token::MOD: {
       RECURSE(VisitWithExpectation(
-          expr->left(), Type::Number(),
+          expr->left(), Type::Number(zone()),
           "left arithmetic operand expected to be number"));
       Type* left_type = computed_type_;
       int left_intish = intish_;
       RECURSE(VisitWithExpectation(
-          expr->right(), Type::Number(),
+          expr->right(), Type::Number(zone()),
           "right arithmetic operand expected to be number"));
       Type* right_type = computed_type_;
       int right_intish = intish_;
       Type* type = Type::Union(left_type, right_type, zone());
       if (type->Is(cache_.kAsmInt)) {
         if (expr->op() == Token::MUL) {
           Literal* right = expr->right()->AsLiteral();
           if (!right) {
             FAIL(expr, "direct integer multiply forbidden");
           }
@@ skipping 21 matching lines @@
             if (intish_ > kMaxUncombinedMultiplicativeSteps) {
               FAIL(expr, "too many consecutive multiplicative ops");
             }
           }
           IntersectResult(expr, cache_.kAsmInt);
           return;
         }
       } else if (expr->op() == Token::MUL && expr->right()->IsLiteral() &&
                  right_type->Is(cache_.kAsmDouble)) {
         // For unary +, expressed as x * 1.0
+        if (expr->left()->IsCall() && expr->op() == Token::MUL) {
+          IntersectResult(expr->left(), cache_.kAsmDouble);
+        }
         IntersectResult(expr, cache_.kAsmDouble);
         return;
       } else if (type->Is(cache_.kAsmFloat) && expr->op() != Token::MOD) {
         if (left_intish != 0 || right_intish != 0) {
           FAIL(expr, "float operation before required fround");
         }
         IntersectResult(expr, cache_.kAsmFloat);
         intish_ = 1;
         return;
       } else if (type->Is(cache_.kAsmDouble)) {
         IntersectResult(expr, cache_.kAsmDouble);
         return;
       } else {
         FAIL(expr, "ill-typed arithmetic operation");
       }
     }
     default:
       UNREACHABLE();
   }
 }
 
 
 void AsmTyper::VisitCompareOperation(CompareOperation* expr) {
+  if (!in_function_) {
+    FAIL(expr, "comparison inside module body");
+  }
   Token::Value op = expr->op();
   if (op != Token::EQ && op != Token::NE && op != Token::LT &&
       op != Token::LTE && op != Token::GT && op != Token::GTE) {
     FAIL(expr, "illegal comparison operator");
   }
 
   RECURSE(
-      VisitWithExpectation(expr->left(), Type::Number(),
+      VisitWithExpectation(expr->left(), Type::Number(zone()),
                            "left comparison operand expected to be number"));
   Type* left_type = computed_type_;
   if (!left_type->Is(cache_.kAsmComparable)) {
     FAIL(expr->left(), "bad type on left side of comparison");
   }
 
   RECURSE(
-      VisitWithExpectation(expr->right(), Type::Number(),
+      VisitWithExpectation(expr->right(), Type::Number(zone()),
                            "right comparison operand expected to be number"));
   Type* right_type = computed_type_;
   if (!right_type->Is(cache_.kAsmComparable)) {
     FAIL(expr->right(), "bad type on right side of comparison");
   }
 
   if (!left_type->Is(right_type) && !right_type->Is(left_type)) {
     FAIL(expr, "left and right side of comparison must match");
   }
 
@@ skipping 38 matching lines @@
 
 
 void AsmTyper::VisitSuperCallReference(SuperCallReference* expr) {
   FAIL(expr, "call reference not allowed");
 }
 
 
 void AsmTyper::InitializeStdlibSIMD() {
 #define V(NAME, Name, name, lane_count, lane_type)                            \
   {                                                                           \
-    Type* type = Type::Function(Type::Name(isolate_, zone()), Type::Any(),    \
-                                lane_count, zone());                          \
+    Type* type = Type::Function(Type::Name(isolate_, zone()),                 \
+                                Type::Any(zone()), lane_count, zone());       \
     for (int i = 0; i < lane_count; ++i) {                                    \
-      type->AsFunction()->InitParameter(i, Type::Number());                   \
+      type->AsFunction()->InitParameter(i, Type::Number(zone()));             \
     }                                                                         \
     stdlib_simd_##name##_constructor_type_ = new (zone()) VariableInfo(type); \
     stdlib_simd_##name##_constructor_type_->is_constructor_function = true;   \
   }
   SIMD128_TYPES(V)
 #undef V
 }
 
 
 void AsmTyper::InitializeStdlib() {
@@ skipping 188 matching lines @@
 
 
 void AsmTyper::VisitRewritableAssignmentExpression(
     RewritableAssignmentExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8