Fix Type::Intersect to allocate large enough union.

src/jsregexp.cc

Index: src/jsregexp.cc
diff --git a/src/jsregexp.cc b/src/jsregexp.cc
index a30fc26ff0121d4aea7511469f3929625a52eb16..0504825777d13dfcbae8e9fae76ead4c2d40213a 100644
--- a/src/jsregexp.cc
+++ b/src/jsregexp.cc
@@ -1907,10 +1907,10 @@ static void CutOutRange(RegExpMacroAssembler* masm,
   // range that is a merger of the two ranges on either side of the one we
   // are cutting out.  The oddity of the labels is preserved.
   for (int j = cut_index; j > start_index; j--) {
-    ranges->at(j) = ranges->at(j - 1);
+    ranges->Set(j, ranges->at(j - 1));
   }
   for (int j = cut_index + 1; j < end_index; j++) {
-    ranges->at(j) = ranges->at(j + 1);
+    ranges->Set(j, ranges->at(j + 1));
   }
 }
 
@@ -3635,7 +3635,7 @@ void BoyerMoorePositionInfo::SetInterval(const Interval& interval) {
   if (interval.to() - interval.from() >= kMapSize - 1) {
     if (map_count_ != kMapSize) {
       map_count_ = kMapSize;
-      for (int i = 0; i < kMapSize; i++) map_->at(i) = true;
+      for (int i = 0; i < kMapSize; i++) map_->Set(i, true);
     }
     return;
   }
@@ -3643,7 +3643,7 @@ void BoyerMoorePositionInfo::SetInterval(const Interval& interval) {
     int mod_character = (i & kMask);
     if (!map_->at(mod_character)) {
       map_count_++;
-      map_->at(mod_character) = true;
+      map_->Set(mod_character, true);
     }
     if (map_count_ == kMapSize) return;
   }
@@ -3654,7 +3654,7 @@ void BoyerMoorePositionInfo::SetAll() {
   s_ = w_ = d_ = kLatticeUnknown;
   if (map_count_ != kMapSize) {
     map_count_ = kMapSize;
-    for (int i = 0; i < kMapSize; i++) map_->at(i) = true;
+    for (int i = 0; i < kMapSize; i++) map_->Set(i, true);
   }
 }
 
@@ -5396,11 +5396,11 @@ static void MoveRanges(ZoneList<CharacterRange>* list,
   // Ranges are potentially overlapping.
   if (from < to) {
     for (int i = count - 1; i >= 0; i--) {
-      list->at(to + i) = list->at(from + i);
+      list->Set(to + i, list->at(from + i));
     }
   } else {
     for (int i = 0; i < count; i++) {
-      list->at(to + i) = list->at(from + i);
+      list->Set(to + i, list->at(from + i));
     }
   }
 }
@@ -5440,7 +5440,7 @@ static int InsertRangeInCanonicalList(ZoneList<CharacterRange>* list,
     if (start_pos < count) {
       MoveRanges(list, start_pos, start_pos + 1, count - start_pos);
     }
-    list->at(start_pos) = insert;
+    list->Set(start_pos, insert);
     return count + 1;
   }
   if (start_pos + 1 == end_pos) {
@@ -5448,7 +5448,7 @@ static int InsertRangeInCanonicalList(ZoneList<CharacterRange>* list,
     CharacterRange to_replace = list->at(start_pos);
     int new_from = Min(to_replace.from(), from);
     int new_to = Max(to_replace.to(), to);
-    list->at(start_pos) = CharacterRange(new_from, new_to);
+    list->Set(start_pos, CharacterRange(new_from, new_to));
     return count;
   }
   // Replace a number of existing ranges from start_pos to end_pos - 1.
@@ -5459,7 +5459,7 @@ static int InsertRangeInCanonicalList(ZoneList<CharacterRange>* list,
   if (end_pos < count) {
     MoveRanges(list, end_pos, start_pos + 1, count - end_pos);
   }
-  list->at(start_pos) = CharacterRange(new_from, new_to);
+  list->Set(start_pos, CharacterRange(new_from, new_to));
   return count - (end_pos - start_pos) + 1;
 }