| Index: src/compiler/verifier.cc
 | 
| diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc
 | 
| index 6a2e493fc32b66dfe4aaf0bd3947d0fd040c7446..ddb6fae35f75a2f5edb728ab6fdc2118cde732cd 100644
 | 
| --- a/src/compiler/verifier.cc
 | 
| +++ b/src/compiler/verifier.cc
 | 
| @@ -689,6 +689,12 @@ void Verifier::Visitor::Check(Node* node) {
 | 
|        break;
 | 
|      case IrOpcode::kSpeculativeNumberAdd:
 | 
|      case IrOpcode::kSpeculativeNumberSubtract:
 | 
| +      CheckUpperIs(node, Type::Number());
 | 
| +      break;
 | 
| +    case IrOpcode::kSpeculativeNumberEqual:
 | 
| +    case IrOpcode::kSpeculativeNumberLessThan:
 | 
| +    case IrOpcode::kSpeculativeNumberLessThanOrEqual:
 | 
| +      CheckUpperIs(node, Type::Boolean());
 | 
|        break;
 | 
|      case IrOpcode::kNumberAdd:
 | 
|      case IrOpcode::kNumberSubtract:
 | 
| 
 |