Fix Handle-related bug in RangeType constructor.

src/types.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPES_H_
 #define V8_TYPES_H_
 
 #include "src/factory.h"
 #include "src/handles.h"
 #include "src/ostreams.h"
@@ skipping 668 matching lines @@
 
   static RangeHandle New(
       double min, double max, TypeHandle bound, Region* region) {
     ASSERT(SEMANTIC(bound->AsBitset() | BitsetType::kNumber)
            == SEMANTIC(BitsetType::kNumber));
     ASSERT(!std::isnan(min) && !std::isnan(max) && min <= max);
     RangeHandle type = Config::template cast<RangeType>(
         StructuralType::New(StructuralType::kRangeTag, 3, region));
     type->Set(0, bound);
     Factory* factory = Config::isolate(region)->factory();
-    type->SetValue(1, factory->NewHeapNumber(min));
-    type->SetValue(2, factory->NewHeapNumber(max));
+    Handle<HeapNumber> minV = factory->NewHeapNumber(min);
+    Handle<HeapNumber> maxV = factory->NewHeapNumber(max);
+    type->SetValue(1, minV);
+    type->SetValue(2, maxV);
     return type;
   }
 
   static RangeHandle New(double min, double max, Region* region) {
     TypeHandle bound = BitsetType::New(BitsetType::kNumber, region);
     return New(min, max, bound, region);
   }
 
   static RangeType* cast(TypeImpl* type) {
     ASSERT(type->IsRange());
@@ skipping 280 matching lines @@
   bool Narrows(BoundsImpl that) {
     return that.lower->Is(this->lower) && this->upper->Is(that.upper);
   }
 };
 
 typedef BoundsImpl<ZoneTypeConfig> Bounds;
 
 } }  // namespace v8::internal
 
 #endif  // V8_TYPES_H_