Fix crash bug in free list when allocating write protected memory.

runtime/vm/freelist.h

Index: runtime/vm/freelist.h
diff --git a/runtime/vm/freelist.h b/runtime/vm/freelist.h
index 9bed00ee4dbe89d3288578c806f10f7d9d12c52b..adfeb636395b9b19a13dca2254500f4abfca7832 100644
--- a/runtime/vm/freelist.h
+++ b/runtime/vm/freelist.h
@@ -19,9 +19,6 @@ namespace dart {
 // the element at the address following the next_ field.
 class FreeListElement {
  public:
-  // Maximum header size is three words (tags, next, and size).
-  static const intptr_t kHeaderSize = 3 * kWordSize;
-
   FreeListElement* next() const {
     return next_;
   }
@@ -43,6 +40,8 @@ class FreeListElement {
 
   static void InitOnce();
 
+  static intptr_t HeaderSizeFor(intptr_t size);
+
   // Used to allocate class for free list elements in Object::InitOnce.
   class FakeInstance {
    public: