Reapply "Move megamorphic cache table into the Dart heap."

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
diff --git a/runtime/vm/snapshot.cc b/runtime/vm/snapshot.cc
index 85099cca5c331ac19b8e367b8c48f82a4de8efe0..3612f1c0c4f1184b39929a069aeace1930e16940 100644
--- a/runtime/vm/snapshot.cc
+++ b/runtime/vm/snapshot.cc
@@ -660,7 +660,9 @@ RawApiError* SnapshotReader::ReadFullSnapshot() {
     HeapLocker hl(isolate, old_space());
 
     // Read in all the objects stored in the object store.
-    intptr_t num_flds = (object_store->to() - object_store->from());
+    RawObject** toobj = snapshot_code() ? object_store->to()
+                                        : object_store->to_snapshot();
+    intptr_t num_flds = (toobj - object_store->from());
     for (intptr_t i = 0; i <= num_flds; i++) {
       *(object_store->from() + i) = ReadObjectImpl(kAsInlinedObject);
     }
@@ -1994,7 +1996,9 @@ void FullSnapshotWriter::WriteIsolateFullSnapshot() {
     // Write out all the objects in the object store of the isolate which
     // is the root set for all dart allocated objects at this point.
     SnapshotWriterVisitor visitor(&writer, false);
-    object_store->VisitObjectPointers(&visitor);
+    visitor.VisitPointers(object_store->from(),
+                          snapshot_code_ ? object_store->to()
+                                         : object_store->to_snapshot());
 
     // Write out all forwarded objects.
     writer.WriteForwardedObjects();