- Properly detag the pointer before using it.

runtime/vm/raw_object_snapshot.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/bigint_operations.h"
 #include "vm/object.h"
 #include "vm/object_store.h"
 #include "vm/snapshot.h"
 #include "vm/symbols.h"
 #include "vm/visitor.h"
@@ skipping 2605 matching lines @@
     writer->WriteInlinedObjectHeader(object_id);
 
     // Write out the class and tags information.
     writer->WriteIndexedObject(kStacktraceCid);
     writer->WriteIntptrValue(writer->GetObjectTags(this));
 
     // Write out all the object pointer fields.
     SnapshotWriterVisitor visitor(writer);
     visitor.VisitPointers(from(), to());
 
-    writer->Write(expand_inlined_);
+    writer->Write(ptr()->expand_inlined_);
   } else {
     // Stacktraces are not allowed in other snapshot forms.
     writer->SetWriteException(Exceptions::kArgument,
                               "Illegal argument in isolate message"
                               " : (object is a stacktrace)");
   }
 }
 
 
 RawJSRegExp* JSRegExp::ReadFrom(SnapshotReader* reader,
@@ skipping 109 matching lines @@
     // We do not allow objects with native fields in an isolate message.
     writer->SetWriteException(Exceptions::kArgument,
                               "Illegal argument in isolate message"
                               " : (object is a MirrorReference)");
   } else {
     UNREACHABLE();
   }
 }
 
 }  // namespace dart