DBC: Fix fast-path allocation with type arguments

runtime/vm/simulator_dbc.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include <setjmp.h>  // NOLINT
 #include <stdlib.h>
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_DBC)
 
@@ skipping 2784 matching lines @@
 
   {
     BYTECODE(AllocateTOpt, A_D);
     const uword tags = Smi::Value(RAW_CAST(Smi, LOAD_CONSTANT(rD)));
     const intptr_t instance_size = RawObject::SizeTag::decode(tags);
     const uword start = thread->heap()->new_space()->TryAllocate(instance_size);
     if (LIKELY(start != 0)) {
       RawObject* type_args = SP[0];
       const intptr_t type_args_offset = Bytecode::DecodeD(*pc);
       *reinterpret_cast<uword*>(start + Instance::tags_offset()) = tags;
-      *reinterpret_cast<RawObject**>(start + type_args_offset) = type_args;
       for (intptr_t current_offset = sizeof(RawInstance);
            current_offset < instance_size;
            current_offset += kWordSize) {
         *reinterpret_cast<RawObject**>(start + current_offset) = null_value;
       }
+      *reinterpret_cast<RawObject**>(start + type_args_offset) = type_args;
       FP[rA] = reinterpret_cast<RawObject*>(start + kHeapObjectTag);
       SP -= 1;  // Consume the type arguments on the stack.
       pc += 4;
     }
     DISPATCH();
   }
 
   {
     BYTECODE(AllocateT, 0);
     SP[1] = SP[-0];  // Class object.
@@ skipping 933 matching lines @@
   pc_ = pc;
   special_[kExceptionSpecialIndex] = raw_exception;
   special_[kStacktraceSpecialIndex] = raw_stacktrace;
   buf->Longjmp();
   UNREACHABLE();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_DBC