[turbofan] Add type to the allocation operator.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 7c3b9bab06b61a4452b093552468290cef1f1228..70b02e28d3ce4335b36aeac3a2c1fb990332ed5c 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -1520,7 +1520,7 @@ JSNativeContextSpecialization::BuildPropertyAccess(
                   common()->BeginRegion(RegionObservability::kNotObservable),
                   effect);
               Node* box = effect = graph()->NewNode(
-                  simplified()->Allocate(NOT_TENURED),
+                  simplified()->Allocate(Type::Number(), NOT_TENURED),

[Benedikt Meurer, 2017/04/06 12:08:05]

This should be Type::OtherInternal(). A MutableHeapNumber is not a HeapNumber.

[Jarin, 2017/04/06 15:11:29]

Done. Good catch!

                   jsgraph()->Constant(HeapNumber::kSize), effect, control);
               effect = graph()->NewNode(
                   simplified()->StoreField(AccessBuilder::ForMap()), box,
@@ -2209,7 +2209,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
   effect = graph()->NewNode(
       common()->BeginRegion(RegionObservability::kNotObservable), effect);
   Node* new_properties = effect = graph()->NewNode(
-      simplified()->Allocate(NOT_TENURED),
+      simplified()->Allocate(Type::Internal(), NOT_TENURED),

[Benedikt Meurer, 2017/04/06 12:08:05]

Nit: Type::OtherInternal()

[Jarin, 2017/04/06 15:11:29]

Done.

       jsgraph()->Constant(FixedArray::SizeFor(new_length)), effect, control);
   effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
                             new_properties, jsgraph()->FixedArrayMapConstant(),