Fix leak of message snapshot buffer when attempting to send an illegal object.

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
diff --git a/runtime/vm/snapshot.cc b/runtime/vm/snapshot.cc
index 13757ecbaee8aaf041b4e0b7ba23ad9f7a4d8d12..55d8a3cd2f4b076f088fad766f478c9e5fe031c3 100644
--- a/runtime/vm/snapshot.cc
+++ b/runtime/vm/snapshot.cc
@@ -1218,10 +1218,11 @@ SnapshotWriter::SnapshotWriter(Thread* thread,
                                Snapshot::Kind kind,
                                uint8_t** buffer,
                                ReAlloc alloc,
+                               DeAlloc dealloc,
                                intptr_t initial_size,
                                ForwardList* forward_list,
                                bool can_send_any_object)
-    : BaseWriter(buffer, alloc, initial_size),
+    : BaseWriter(buffer, alloc, dealloc, initial_size),
       thread_(thread),
       kind_(kind),
       object_store_(isolate()->object_store()),
@@ -1883,6 +1884,7 @@ ScriptSnapshotWriter::ScriptSnapshotWriter(uint8_t** buffer, ReAlloc alloc)
                      Snapshot::kScript,
                      buffer,
                      alloc,
+                     NULL,
                      kInitialSize,
                      &forward_list_,
                      true /* can_send_any_object */),
@@ -1932,11 +1934,13 @@ void SnapshotWriterVisitor::VisitPointers(RawObject** first, RawObject** last) {
 
 MessageWriter::MessageWriter(uint8_t** buffer,
                              ReAlloc alloc,
+                             DeAlloc dealloc,
                              bool can_send_any_object)
     : SnapshotWriter(Thread::Current(),
                      Snapshot::kMessage,
                      buffer,
                      alloc,
+                     dealloc,
                      kInitialSize,
                      &forward_list_,
                      can_send_any_object),
@@ -1957,6 +1961,7 @@ void MessageWriter::WriteMessage(const Object& obj) {
     NoSafepointScope no_safepoint;
     WriteObject(obj.raw());
   } else {
+    FreeBuffer();
     ThrowException(exception_type(), exception_msg());
   }
 }