Fix snapshotting of TypeArguments.

runtime/vm/dart_api_message.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/bigint_operations.h"
 #include "vm/dart_api_message.h"
 #include "vm/object.h"
 #include "vm/snapshot_ids.h"
 #include "vm/symbols.h"
 #include "vm/unicode.h"
@@ skipping 469 matching lines @@
              Dart_CObject_kString);
       return object;
     }
     case kTypeArgumentsCid: {
       // TODO(sjesse): Remove this when message serialization format is
       // updated (currently length is leaked).
       Dart_CObject* value = &type_arguments_marker;
       AddBackRef(object_id, value, kIsDeserialized);
       Dart_CObject* length = ReadObjectImpl();
       ASSERT(length->type == Dart_CObject_kInt32);
+      ReadObjectImpl();  // Read and skip instantiations_ field.
       for (int i = 0; i < length->value.as_int32; i++) {
         Dart_CObject* type = ReadObjectImpl();
         if (type != &dynamic_type_marker) {
           return AllocateDartCObjectUnsupported();
         }
       }
       return value;
     }
     case kTypeParameterCid: {
       // TODO(sgjesse): Fix this workaround ignoring the type parameter.
@@ skipping 672 matching lines @@
     if (!success) {
       UnmarkAllCObjects(object);
       return false;
     }
   }
   UnmarkAllCObjects(object);
   return true;
 }
 
 }  // namespace dart