Allow intish and floatish to be coerced by heap assignment.

src/typing-asm.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/typing-asm.h"
 
 #include <limits>
 
 #include "src/v8.h"
 
@@ skipping 665 matching lines @@
       if (building_function_tables_) {
         return;
       }
     }
   }
   if (expr->is_compound()) FAIL(expr, "compound assignment encountered");
   Type* type = expected_type_;
   RECURSE(VisitWithExpectation(
       expr->value(), type, "assignment value expected to match surrounding"));
   Type* target_type = StorageType(computed_type_);
-  if (intish_ != 0) {
-    FAIL(expr, "intish or floatish assignment");
-  }
   if (expr->target()->IsVariableProxy()) {
+    if (intish_ != 0) {
+      FAIL(expr, "intish or floatish assignment");
+    }
     expected_type_ = target_type;
     VisitVariableProxy(expr->target()->AsVariableProxy(), true);
   } else if (expr->target()->IsProperty()) {
+    int value_intish = intish_;
     Property* property = expr->target()->AsProperty();
     RECURSE(VisitWithExpectation(property->obj(), Type::Any(),
                                  "bad propety object"));
     if (!computed_type_->IsArray()) {
       FAIL(property->obj(), "array expected");
     }
+    if (value_intish != 0 && computed_type_->Is(cache_.kFloat64Array)) {
+      FAIL(expr, "floatish assignment to double array");
+    }
     VisitHeapAccess(property, true, target_type);
   }
   IntersectResult(expr, target_type);
 }
 
 
 void AsmTyper::VisitYield(Yield* expr) {
   FAIL(expr, "yield expression encountered");
 }
 
@@ skipping 842 matching lines @@
 }
 
 
 void AsmTyper::VisitRewritableExpression(RewritableExpression* expr) {
   RECURSE(Visit(expr->expression()));
 }
 
 
 }  // namespace internal
 }  // namespace v8