Fix Handle-related bug in RangeType constructor.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/415603002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/types.h b/src/types.h
index 1b2cf66c96eab48cbff0a00a5a4e0a426c1cbd60..d316fa19aa4322d782ac298924a2ba96dabd7398 100644 (file)
--- a/src/types.h
+++ b/src/types.h
@@ -686,8 +686,10 @@ class TypeImpl<Config>::RangeType : public StructuralType {
         StructuralType::New(StructuralType::kRangeTag, 3, region));
     type->Set(0, bound);
     Factory* factory = Config::isolate(region)->factory();
-    type->SetValue(1, factory->NewHeapNumber(min));
-    type->SetValue(2, factory->NewHeapNumber(max));
+    Handle<HeapNumber> minV = factory->NewHeapNumber(min);
+    Handle<HeapNumber> maxV = factory->NewHeapNumber(max);
+    type->SetValue(1, minV);
+    type->SetValue(2, maxV);
     return type;
   }