Properly account for RawObject size.

runtime/vm/raw_object.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/raw_object.h"
 
 #include "vm/isolate.h"
 #include "vm/object.h"
 #include "vm/visitor.h"
 
@@ skipping 359 matching lines @@
 intptr_t RawInstance::VisitInstancePointers(RawInstance* raw_obj,
                                             ObjectPointerVisitor* visitor) {
   // Make sure that we got here with the tagged pointer as this.
   ASSERT(raw_obj->IsHeapObject());
   RawInstance* obj = raw_obj->ptr();
   intptr_t instance_size = obj->class_->ptr()->instance_size_;
   intptr_t num_native_fields = obj->class_->ptr()->num_native_fields_;
 
   // Calculate the first and last raw object pointer fields.
   uword obj_addr = RawObject::ToAddr(raw_obj);
-  uword from = obj_addr +  ((num_native_fields + 1) * kWordSize);
+  uword from = obj_addr + sizeof(RawObject) + num_native_fields * kWordSize;
   uword to = obj_addr + instance_size - kWordSize;
   visitor->VisitPointers(reinterpret_cast<RawObject**>(from),
                          reinterpret_cast<RawObject**>(to));
   return instance_size;
 }
 
 
 intptr_t RawNumber::VisitNumberPointers(RawNumber* raw_obj,
                                         ObjectPointerVisitor* visitor) {
   // Number is an abstract class.
@@ skipping 154 matching lines @@
 intptr_t RawJSRegExp::VisitJSRegExpPointers(RawJSRegExp* raw_obj,
                                             ObjectPointerVisitor* visitor) {
   // Make sure that we got here with the tagged pointer as this.
   ASSERT(raw_obj->IsHeapObject());
   intptr_t length = Smi::Value(raw_obj->ptr()->data_length_);
   visitor->VisitPointers(raw_obj->from(), raw_obj->to());
   return JSRegExp::InstanceSize(length);
 }
 
 }  // namespace dart