Fix Handle-related bug in RangeType constructor.

src/types.h

Index: src/types.h
diff --git a/src/types.h b/src/types.h
index 1b2cf66c96eab48cbff0a00a5a4e0a426c1cbd60..d316fa19aa4322d782ac298924a2ba96dabd7398 100644
--- a/src/types.h
+++ b/src/types.h
@@ -686,8 +686,10 @@ class TypeImpl<Config>::RangeType : public StructuralType {
         StructuralType::New(StructuralType::kRangeTag, 3, region));
     type->Set(0, bound);
     Factory* factory = Config::isolate(region)->factory();
-    type->SetValue(1, factory->NewHeapNumber(min));
-    type->SetValue(2, factory->NewHeapNumber(max));
+    Handle<HeapNumber> minV = factory->NewHeapNumber(min);
+    Handle<HeapNumber> maxV = factory->NewHeapNumber(max);
+    type->SetValue(1, minV);
+    type->SetValue(2, maxV);
     return type;
   }