Fix dartbug.com/15963:

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
===================================================================
--- runtime/vm/snapshot.cc	(revision 31744)
+++ runtime/vm/snapshot.cc	(working copy)
@@ -478,6 +478,16 @@
 }
 
 
+RawInstance* SnapshotReader::NewInstance() {
+  ASSERT(kind_ == Snapshot::kFull);
+  ASSERT(isolate()->no_gc_scope_depth() != 0);
+  cls_ = object_store()->object_class();
+  RawInstance* obj = reinterpret_cast<RawInstance*>(
+      AllocateUninitialized(cls_, Instance::InstanceSize()));
+  return obj;
+}
+
+
 RawMint* SnapshotReader::NewMint(int64_t value) {
   ASSERT(kind_ == Snapshot::kFull);
   ASSERT(isolate()->no_gc_scope_depth() != 0);
@@ -701,6 +711,10 @@
     ErrorHandle()->set_exception(exception);
     Isolate::Current()->long_jump_base()->Jump(1, *ErrorHandle());
   }
+  // Make sure to initialize the last word, as this can be left untouched in
+  // case the object deserialized has an alignment tail.
+  *reinterpret_cast<RawObject**>(address + size - kWordSize) = Object::null();
+
   RawObject* raw_obj = reinterpret_cast<RawObject*>(address + kHeapObjectTag);
   uword tags = 0;
   intptr_t index = cls.id();