FYI -- apparently, there are more bugs...

src/types.cc

Index: src/types.cc
diff --git a/src/types.cc b/src/types.cc
index 3abc08dd9c15fd1816eaae1d89d97f1662dc469a..c713522ff855cee8a989f15200bea2c9fdf8618b 100644
--- a/src/types.cc
+++ b/src/types.cc
@@ -306,6 +306,9 @@ bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
 
 template<class Config>
 bool TypeImpl<Config>::NowIs(TypeImpl* that) {
+  // TODO(rossberg): this is incorrect for
+  //   Union(Constant(V), T)->NowIs(Class(M))
+  // but fuzzing does not cover that!
   DisallowHeapAllocation no_allocation;
   if (this->IsConstant()) {
     i::Object* object = *this->AsConstant();
@@ -448,12 +451,12 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Union(
     size += (type2->IsUnion() ? Config::struct_length(type2->AsUnion()) : 1);
   }
   int bitset = type1->GlbBitset() | type2->GlbBitset();
-  if (IsInhabited(bitset)) ++size;
+  if (bitset != kNone) ++size;
   ASSERT(size >= 1);
   StructHandle unioned = Config::struct_create(kUnionTag, size, region);
 
   size = 0;
-  if (IsInhabited(bitset)) {
+  if (bitset != kNone) {
     Config::struct_set(unioned, size++, Config::from_bitset(bitset, region));
   }
   size = ExtendUnion(unioned, type1, size);
@@ -524,12 +527,12 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Intersect(
                type2->IsUnion() ? Config::struct_length(type2->AsUnion()) : 1);
   }
   int bitset = type1->GlbBitset() & type2->GlbBitset();
-  if (IsInhabited(bitset)) ++size;
+  if (bitset != kNone) ++size;
   ASSERT(size >= 1);
   StructHandle unioned = Config::struct_create(kUnionTag, size, region);
 
   size = 0;
-  if (IsInhabited(bitset)) {
+  if (bitset != kNone) {
     Config::struct_set(unioned, size++, Config::from_bitset(bitset, region));
   }
   size = ExtendIntersection(unioned, type1, type2, size);