Fix Type::Intersect to allocate large enough union.

src/heap-snapshot-generator.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 669 matching lines @@
 
 void HeapObjectsMap::RemoveDeadEntries() {
   ASSERT(entries_.length() > 0 &&
          entries_.at(0).id == 0 &&
          entries_.at(0).addr == NULL);
   int first_free_entry = 1;
   for (int i = 1; i < entries_.length(); ++i) {
     EntryInfo& entry_info = entries_.at(i);
     if (entry_info.accessed) {
       if (first_free_entry != i) {
-        entries_.at(first_free_entry) = entry_info;
+        entries_.Set(first_free_entry, entry_info);
       }
       entries_.at(first_free_entry).accessed = false;
       HashMap::Entry* entry = entries_map_.Lookup(
           entry_info.addr, ComputePointerHash(entry_info.addr), false);
       ASSERT(entry);
       entry->value = reinterpret_cast<void*>(first_free_entry);
       ++first_free_entry;
     } else {
       if (entry_info.addr) {
         entries_map_.Remove(entry_info.addr,
@@ skipping 2375 matching lines @@
   writer_->AddString("\"<dummy>\"");
   for (int i = 1; i < sorted_strings.length(); ++i) {
     writer_->AddCharacter(',');
     SerializeString(sorted_strings[i]);
     if (writer_->aborted()) return;
   }
 }
 
 
 } }  // namespace v8::internal