FYI -- apparently, there are more bugs...

src/types.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "types.h"
 
 #include "string-stream.h"
 #include "types-inl.h"
 
 namespace v8 {
@@ skipping 288 matching lines @@
     }
     return false;
   }
 
   return false;
 }
 
 
 template<class Config>
 bool TypeImpl<Config>::NowIs(TypeImpl* that) {
+  // TODO(rossberg): this is incorrect for
+  //   Union(Constant(V), T)->NowIs(Class(M))
+  // but fuzzing does not cover that!
   DisallowHeapAllocation no_allocation;
   if (this->IsConstant()) {
     i::Object* object = *this->AsConstant();
     if (object->IsHeapObject()) {
       i::Map* map = i::HeapObject::cast(object)->map();
       for (Iterator<i::Map> it = that->Classes(); !it.Done(); it.Advance()) {
         if (*it.Current() == map) return true;
       }
     }
   }
@@ skipping 122 matching lines @@
 
   // Slow case: may need to produce a Unioned object.
   int size = 0;
   if (!type1->IsBitset()) {
     size += (type1->IsUnion() ? Config::struct_length(type1->AsUnion()) : 1);
   }
   if (!type2->IsBitset()) {
     size += (type2->IsUnion() ? Config::struct_length(type2->AsUnion()) : 1);
   }
   int bitset = type1->GlbBitset() | type2->GlbBitset();
-  if (IsInhabited(bitset)) ++size;
+  if (bitset != kNone) ++size;
   ASSERT(size >= 1);
   StructHandle unioned = Config::struct_create(kUnionTag, size, region);
 
   size = 0;
-  if (IsInhabited(bitset)) {
+  if (bitset != kNone) {
     Config::struct_set(unioned, size++, Config::from_bitset(bitset, region));
   }
   size = ExtendUnion(unioned, type1, size);
   size = ExtendUnion(unioned, type2, size);
 
   if (size == 1) {
     return Config::struct_get(unioned, 0);
   } else {
     Config::struct_shrink(unioned, size);
     return Config::from_struct(unioned);
@@ skipping 50 matching lines @@
   // Slow case: may need to produce a Unioned object.
   int size = INT_MAX;
   if (!type1->IsBitset()) {
     size = (type1->IsUnion() ? Config::struct_length(type1->AsUnion()) : 1);
   }
   if (!type2->IsBitset()) {
     size = Min(size,
                type2->IsUnion() ? Config::struct_length(type2->AsUnion()) : 1);
   }
   int bitset = type1->GlbBitset() & type2->GlbBitset();
-  if (IsInhabited(bitset)) ++size;
+  if (bitset != kNone) ++size;
   ASSERT(size >= 1);
   StructHandle unioned = Config::struct_create(kUnionTag, size, region);
 
   size = 0;
-  if (IsInhabited(bitset)) {
+  if (bitset != kNone) {
     Config::struct_set(unioned, size++, Config::from_bitset(bitset, region));
   }
   size = ExtendIntersection(unioned, type1, type2, size);
   size = ExtendIntersection(unioned, type2, type1, size);
 
   if (size == 0) {
     return None(region);
   } else if (size == 1) {
     return Config::struct_get(unioned, 0);
   } else {
@@ skipping 145 matching lines @@
 template class TypeImpl<HeapTypeConfig>::Iterator<i::Object>;
 
 template TypeImpl<ZoneTypeConfig>::TypeHandle
   TypeImpl<ZoneTypeConfig>::Convert<HeapType>(
     TypeImpl<HeapTypeConfig>::TypeHandle, TypeImpl<ZoneTypeConfig>::Region*);
 template TypeImpl<HeapTypeConfig>::TypeHandle
   TypeImpl<HeapTypeConfig>::Convert<Type>(
     TypeImpl<ZoneTypeConfig>::TypeHandle, TypeImpl<HeapTypeConfig>::Region*);
 
 } }  // namespace v8::internal