Fix dartbug.com/15963:

runtime/vm/snapshot.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/snapshot.h"
 
 #include "platform/assert.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
 #include "vm/class_finalizer.h"
@@ skipping 460 matching lines @@
       AllocateUninitialized(cls_, Class::InstanceSize()));
   Instance fake;
   obj->ptr()->handle_vtable_ = fake.vtable();
   cls_ = obj;
   cls_.set_id(kIllegalCid);
   isolate()->RegisterClass(cls_);
   return cls_.raw();
 }
 
 
+RawInstance* SnapshotReader::NewInstance() {
+  ASSERT(kind_ == Snapshot::kFull);
+  ASSERT(isolate()->no_gc_scope_depth() != 0);
+  cls_ = object_store()->object_class();
+  RawInstance* obj = reinterpret_cast<RawInstance*>(
+      AllocateUninitialized(cls_, Instance::InstanceSize()));
+  return obj;
+}
+
+
 RawMint* SnapshotReader::NewMint(int64_t value) {
   ASSERT(kind_ == Snapshot::kFull);
   ASSERT(isolate()->no_gc_scope_depth() != 0);
   cls_ = object_store()->mint_class();
   RawMint* obj = reinterpret_cast<RawMint*>(
       AllocateUninitialized(cls_, Mint::InstanceSize()));
   obj->ptr()->value_ = value;
   return obj;
 }
 
@@ skipping 203 matching lines @@
   if (address == 0) {
     // Use the preallocated out of memory exception to avoid calling
     // into dart code or allocating any code.
     // We do a longjmp at this point to unwind out of the entire
     // read part and return the error object back.
     const Instance& exception =
         Instance::Handle(object_store()->out_of_memory());
     ErrorHandle()->set_exception(exception);
     Isolate::Current()->long_jump_base()->Jump(1, *ErrorHandle());
   }
+  // Make sure to initialize the last word, as this can be left untouched in
+  // case the object deserialized has an alignment tail.
+  *reinterpret_cast<RawObject**>(address + size - kWordSize) = Object::null();
+
   RawObject* raw_obj = reinterpret_cast<RawObject*>(address + kHeapObjectTag);
   uword tags = 0;
   intptr_t index = cls.id();
   ASSERT(index != kIllegalCid);
   tags = RawObject::ClassIdTag::update(index, tags);
   tags = RawObject::SizeTag::update(size, tags);
   raw_obj->ptr()->tags_ = tags;
   return raw_obj;
 }
 
@@ skipping 790 matching lines @@
     NoGCScope no_gc;
     WriteObject(obj.raw());
     UnmarkAll();
   } else {
     ThrowException(exception_type(), exception_msg());
   }
 }
 
 
 }  // namespace dart