Aseem, can you take a look at this one?
It looks like arguments being special ends up causing env to be from the context. This is probably just a matter of checking the same condition in the typer earlier.

This repros with the following:

function Module(stdlib, env, heap) {
  "use asm";

  var a = new stdlib.Int32Array(heap);
  var b = new stdlib.Float32Array(heap);
  var fround = stdlib.Math.fround;
  var value = env.value|0;

  function foo() {
    var x = fround(0.0);
    x = (a[0]=value|0,fround(b[0]));
    return fround(x);
  }

  return arguments.length;
}

Module();

Should no longer happen with the new validator. I triggered a redo on ClusterFuzz.

No longer applies to new validator.