[turbofan] Fix type of JSCreateClosure to be Function.

The JSCreateClosure operator always produces a function, so the type
should reflect that.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1532503002

Cr-Commit-Position: refs/heads/master@{#32881}

src/compiler/typer.cc

@@ -1217,7 +1217,7 @@ Type* Typer::Visitor::TypeJSCreateArray(Node* node) {
 
 
 Type* Typer::Visitor::TypeJSCreateClosure(Node* node) {
-  return Type::OtherObject();
+  return Type::Function();
 }
 
 

src/compiler/verifier.cc

@@ -516,7 +516,7 @@ void Verifier::Visitor::Check(Node* node) {
       break;
     case IrOpcode::kJSCreateClosure:
       // Type is Function.
-      CheckUpperIs(node, Type::OtherObject());
+      CheckUpperIs(node, Type::Function());
       break;
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject: