Fix a bug in type fuzzing and several handlification bugs elsewhere.

test/cctest/test-types.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <vector>
 
 #include "src/hydrogen-types.h"
 #include "src/isolate-inl.h"
 #include "src/types.h"
 #include "test/cctest/cctest.h"
@@ skipping 259 matching lines @@
         int depth = rng_->NextInt(3);
         TypeHandle type = Type::Internal(region_);
         for (int i = 0; i < depth; ++i) type = Type::Context(type, region_);
         return type;
       }
       case 4: {  // array
         TypeHandle element = Fuzz(depth / 2);
         return Type::Array(element, region_);
       }
       case 5:
-      case 6:
-      case 7: {  // function
+      case 6: {  // function
         TypeHandle result = Fuzz(depth / 2);
         TypeHandle receiver = Fuzz(depth / 2);
         int arity = rng_->NextInt(3);
         TypeHandle type = Type::Function(result, receiver, arity, region_);
         for (int i = 0; i < type->AsFunction()->Arity(); ++i) {
-          TypeHandle parameter = Fuzz(depth - 1);
+          TypeHandle parameter = Fuzz(depth / 2);
           type->AsFunction()->InitParameter(i, parameter);
         }
+        return type;
       }
       default: {  // union
         int n = rng_->NextInt(10);
         TypeHandle type = None;
         for (int i = 0; i < n; ++i) {
           TypeHandle operand = Fuzz(depth - 1);
           type = Type::Union(type, operand, region_);
         }
         return type;
       }
@@ skipping 1644 matching lines @@
   ZoneTests().Convert<HeapType, Handle<HeapType>, Isolate, HeapRep>();
   HeapTests().Convert<Type, Type*, Zone, ZoneRep>();
 }
 
 
 TEST(HTypeFromType) {
   CcTest::InitializeVM();
   ZoneTests().HTypeFromType();
   HeapTests().HTypeFromType();
 }