Fix for issue 28854.

runtime/vm/snapshot.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/snapshot.h"
 
 #include "platform/assert.h"
 #include "vm/bootstrap.h"
 #include "vm/class_finalizer.h"
 #include "vm/dart.h"
@@ skipping 222 matching lines @@
   LongJumpScope jump;
   if (setjmp(*jump.Set()) == 0) {
     PassiveObject& obj =
         PassiveObject::Handle(zone(), ReadObjectImpl(kAsInlinedObject));
     for (intptr_t i = 0; i < backward_references_->length(); i++) {
       if (!(*backward_references_)[i].is_deserialized()) {
         ReadObjectImpl(kAsInlinedObject);
         (*backward_references_)[i].set_state(kIsDeserialized);
       }
     }
-    ProcessDeferredCanonicalizations();
-    return obj.raw();
+    if (backward_references_->length() > 0) {
+      ProcessDeferredCanonicalizations();
+      return (*backward_references_)[0].reference()->raw();
+    } else {
+      return obj.raw();
+    }
   } else {
     // An error occurred while reading, return the error object.
     const Error& err = Error::Handle(thread()->sticky_error());
     thread()->clear_sticky_error();
     return err.raw();
   }
 }
 
 
 RawClass* SnapshotReader::ReadClassId(intptr_t object_id) {
@@ skipping 249 matching lines @@
     intptr_t next_field_offset = cls_.next_field_offset();
 
     intptr_t type_argument_field_offset = cls_.type_arguments_field_offset();
     ASSERT(next_field_offset > 0);
     // Instance::NextFieldOffset() returns the offset of the first field in
     // a Dart object.
     bool read_as_reference = RawObject::IsCanonical(tags) ? false : true;
     intptr_t offset = Instance::NextFieldOffset();
     intptr_t result_cid = result->GetClassId();
     while (offset < next_field_offset) {
-      pobj_ = ReadObjectImpl(read_as_reference);
+      pobj_ =
+          ReadObjectImpl(read_as_reference, object_id, (offset / kWordSize));
       result->SetFieldAtOffset(offset, pobj_);
       if ((offset != type_argument_field_offset) &&
           (kind_ == Snapshot::kMessage) && isolate()->use_field_guards()) {
         // TODO(fschneider): Consider hoisting these lookups out of the loop.
         // This would involve creating a handle, since cls_ can't be reused
         // across the call to ReadObjectImpl.
         cls_ = isolate()->class_table()->At(result_cid);
         array_ = cls_.OffsetToFieldMap();
         field_ ^= array_.At(offset >> kWordSizeLog2);
         ASSERT(!field_.IsNull());
@@ skipping 685 matching lines @@
         typeobj ^= objref->raw();
         newobj = typeobj.Canonicalize();
       } else {
         ASSERT(objref->IsTypeArguments());
         typeargs ^= objref->raw();
         newobj = typeargs.Canonicalize();
       }
       if (newobj.raw() != objref->raw()) {
         ZoneGrowableArray<intptr_t>* patches = backref.patch_records();
         ASSERT(newobj.IsNull() || newobj.IsCanonical());
-        ASSERT(patches != NULL);
         // First we replace the back ref table with the canonical object.
         *objref = newobj.raw();
-        // Now we go over all the patch records and patch the canonical object.
-        for (intptr_t j = 0; j < patches->length(); j += 2) {
-          NoSafepointScope no_safepoint;
-          intptr_t patch_object_id = (*patches)[j];
-          intptr_t patch_offset = (*patches)[j + 1];
-          Object* target = GetBackRef(patch_object_id);
-          // We should not backpatch an object that is canonical.
-          if (!target->IsCanonical()) {
-            RawObject** rawptr =
-                reinterpret_cast<RawObject**>(target->raw()->ptr());
-            target->StorePointer((rawptr + patch_offset), newobj.raw());
+        if (patches != NULL) {
+          // Now go over all the patch records and patch the canonical object.
+          for (intptr_t j = 0; j < patches->length(); j += 2) {
+            NoSafepointScope no_safepoint;
+            intptr_t patch_object_id = (*patches)[j];
+            intptr_t patch_offset = (*patches)[j + 1];
+            Object* target = GetBackRef(patch_object_id);
+            // We should not backpatch an object that is canonical.
+            if (!target->IsCanonical()) {
+              RawObject** rawptr =
+                  reinterpret_cast<RawObject**>(target->raw()->ptr());
+              target->StorePointer((rawptr + patch_offset), newobj.raw());
+            }
           }
         }
       } else {
         ASSERT(objref->IsCanonical());
       }
     }
   }
 }
 
 
@@ skipping 802 matching lines @@
       *buffer_len_ = BytesWritten();
     }
   } else {
     FreeBuffer();
     ThrowException(exception_type(), exception_msg());
   }
 }
 
 
 }  // namespace dart