Fix a bug in type fuzzing and several handlification bugs elsewhere.

test/cctest/test-types.cc

Index: test/cctest/test-types.cc
diff --git a/test/cctest/test-types.cc b/test/cctest/test-types.cc
index 753457366701c26be2af0c798663fac2e7a092aa..9279ccb9ede954c81e29895f7325d556e2724a5e 100644
--- a/test/cctest/test-types.cc
+++ b/test/cctest/test-types.cc
@@ -277,16 +277,16 @@ class Types {
         return Type::Array(element, region_);
       }
       case 5:
-      case 6:
-      case 7: {  // function
+      case 6: {  // function
         TypeHandle result = Fuzz(depth / 2);
         TypeHandle receiver = Fuzz(depth / 2);
         int arity = rng_->NextInt(3);
         TypeHandle type = Type::Function(result, receiver, arity, region_);
         for (int i = 0; i < type->AsFunction()->Arity(); ++i) {
-          TypeHandle parameter = Fuzz(depth - 1);
+          TypeHandle parameter = Fuzz(depth / 2);
           type->AsFunction()->InitParameter(i, parameter);
         }
+        return type;
       }
       default: {  // union
         int n = rng_->NextInt(10);