Fix Type::Intersect to allocate large enough union.

src/jsregexp.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1889 matching lines @@
                          ranges->at(cut_index),
                          ranges->at(cut_index + 1) - 1,
                          &dummy,
                          in_range_label,
                          &dummy);
   ASSERT(!dummy.is_linked());
   // Cut out the single range by rewriting the array.  This creates a new
   // range that is a merger of the two ranges on either side of the one we
   // are cutting out.  The oddity of the labels is preserved.
   for (int j = cut_index; j > start_index; j--) {
-    ranges->at(j) = ranges->at(j - 1);
+    ranges->Set(j, ranges->at(j - 1));
   }
   for (int j = cut_index + 1; j < end_index; j++) {
-    ranges->at(j) = ranges->at(j + 1);
+    ranges->Set(j, ranges->at(j + 1));
   }
 }
 
 
 // Unicode case.  Split the search space into kSize spaces that are handled
 // with recursion.
 static void SplitSearchSpace(ZoneList<int>* ranges,
                              int start_index,
                              int end_index,
                              int* new_start_index,
@@ skipping 1704 matching lines @@
 
 void BoyerMoorePositionInfo::SetInterval(const Interval& interval) {
   s_ = AddRange(s_, kSpaceRanges, kSpaceRangeCount, interval);
   w_ = AddRange(w_, kWordRanges, kWordRangeCount, interval);
   d_ = AddRange(d_, kDigitRanges, kDigitRangeCount, interval);
   surrogate_ =
       AddRange(surrogate_, kSurrogateRanges, kSurrogateRangeCount, interval);
   if (interval.to() - interval.from() >= kMapSize - 1) {
     if (map_count_ != kMapSize) {
       map_count_ = kMapSize;
-      for (int i = 0; i < kMapSize; i++) map_->at(i) = true;
+      for (int i = 0; i < kMapSize; i++) map_->Set(i, true);
     }
     return;
   }
   for (int i = interval.from(); i <= interval.to(); i++) {
     int mod_character = (i & kMask);
     if (!map_->at(mod_character)) {
       map_count_++;
-      map_->at(mod_character) = true;
+      map_->Set(mod_character, true);
     }
     if (map_count_ == kMapSize) return;
   }
 }
 
 
 void BoyerMoorePositionInfo::SetAll() {
   s_ = w_ = d_ = kLatticeUnknown;
   if (map_count_ != kMapSize) {
     map_count_ = kMapSize;
-    for (int i = 0; i < kMapSize; i++) map_->at(i) = true;
+    for (int i = 0; i < kMapSize; i++) map_->Set(i, true);
   }
 }
 
 
 BoyerMooreLookahead::BoyerMooreLookahead(
     int length, RegExpCompiler* compiler, Zone* zone)
     : length_(length),
       compiler_(compiler) {
   if (compiler->ascii()) {
     max_char_ = String::kMaxOneByteCharCode;
@@ skipping 1721 matching lines @@
 
 // Move a number of elements in a zonelist to another position
 // in the same list. Handles overlapping source and target areas.
 static void MoveRanges(ZoneList<CharacterRange>* list,
                        int from,
                        int to,
                        int count) {
   // Ranges are potentially overlapping.
   if (from < to) {
     for (int i = count - 1; i >= 0; i--) {
-      list->at(to + i) = list->at(from + i);
+      list->Set(to + i, list->at(from + i));
     }
   } else {
     for (int i = 0; i < count; i++) {
-      list->at(to + i) = list->at(from + i);
+      list->Set(to + i, list->at(from + i));
     }
   }
 }
 
 
 static int InsertRangeInCanonicalList(ZoneList<CharacterRange>* list,
                                       int count,
                                       CharacterRange insert) {
   // Inserts a range into list[0..count[, which must be sorted
   // by from value and non-overlapping and non-adjacent, using at most
@@ skipping 19 matching lines @@
   // not affected by the insertion.
   // If start_pos == end_pos, the range must be inserted before start_pos.
   // if start_pos < end_pos, the entire range from start_pos to end_pos
   // must be merged with the insert range.
 
   if (start_pos == end_pos) {
     // Insert between existing ranges at position start_pos.
     if (start_pos < count) {
       MoveRanges(list, start_pos, start_pos + 1, count - start_pos);
     }
-    list->at(start_pos) = insert;
+    list->Set(start_pos, insert);
     return count + 1;
   }
   if (start_pos + 1 == end_pos) {
     // Replace single existing range at position start_pos.
     CharacterRange to_replace = list->at(start_pos);
     int new_from = Min(to_replace.from(), from);
     int new_to = Max(to_replace.to(), to);
-    list->at(start_pos) = CharacterRange(new_from, new_to);
+    list->Set(start_pos, CharacterRange(new_from, new_to));
     return count;
   }
   // Replace a number of existing ranges from start_pos to end_pos - 1.
   // Move the remaining ranges down.
 
   int new_from = Min(list->at(start_pos).from(), from);
   int new_to = Max(list->at(end_pos - 1).to(), to);
   if (end_pos < count) {
     MoveRanges(list, end_pos, start_pos + 1, count - end_pos);
   }
-  list->at(start_pos) = CharacterRange(new_from, new_to);
+  list->Set(start_pos, CharacterRange(new_from, new_to));
   return count - (end_pos - start_pos) + 1;
 }
 
 
 void CharacterSet::Canonicalize() {
   // Special/default classes are always considered canonical. The result
   // of calling ranges() will be sorted.
   if (ranges_ == NULL) return;
   CharacterRange::Canonicalize(ranges_);
 }
@@ skipping 652 matching lines @@
   }
 
   return compiler.Assemble(&macro_assembler,
                            node,
                            data->capture_count,
                            pattern);
 }
 
 
 }}  // namespace v8::internal