Better typing and type verification

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 886846eaddd193a13b9fab13e81176f00da2b615..b0b5dee9db956e689c556dbd4ec13824402692ad 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -612,11 +612,12 @@ static Reduction ReplaceWithReduction(Node* node, Reduction reduction) {
 Reduction JSTypedLowering::Reduce(Node* node) {
   // Check if the output type is a singleton.  In that case we already know the
   // result value and can simply replace the node unless there are effects.
-  if (node->bounds().upper->IsConstant() &&
+  if (NodeProperties::IsTyped(node) &&
+      NodeProperties::GetBounds(node).upper->IsConstant() &&
       !IrOpcode::IsLeafOpcode(node->opcode()) &&
       !OperatorProperties::HasEffectOutput(node->op())) {
     return ReplaceEagerly(node, jsgraph()->Constant(
-        node->bounds().upper->AsConstant()->Value()));
+        NodeProperties::GetBounds(node).upper->AsConstant()->Value()));
     // TODO(neis): Extend this to Range(x,x), NaN, MinusZero, ...?
   }
   switch (node->opcode()) {