Fix Type::Intersect to allocate large enough union.

src/global-handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 608 matching lines @@
       Object* object = *objects[j];
       if (object->IsHeapObject()) {
         v->VisitPointer(&object);
         any_group_was_visited = true;
       }
     }
 
     // Once the entire group has been iterated over, set the object
     // group to NULL so it won't be processed again.
     delete entry;
-    object_groups_.at(i) = NULL;
+    object_groups_.Set(i, NULL);
   }
   object_groups_.Rewind(last);
   return any_group_was_visited;
 }
 
 
 bool GlobalHandles::PostGarbageCollectionProcessing(
     GarbageCollector collector, GCTracer* tracer) {
   // Process weak global handle callbacks. This must be done after the
   // GC is completely done, because the callbacks may invoke arbitrary
@@ skipping 446 matching lines @@
   ASSERT_EQ(isolate->heap()->the_hole_value(), blocks_[block][offset]);
   blocks_[block][offset] = object;
   if (isolate->heap()->InNewSpace(object)) {
     new_space_indices_.Add(size_);
   }
   *index = size_++;
 }
 
 
 } }  // namespace v8::internal