Compute next field offset correctly.

runtime/vm/stub_code_ia32.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"
 #if defined(TARGET_ARCH_IA32)
 
 #include "vm/assembler.h"
 #include "vm/compiler.h"
 #include "vm/dart_entry.h"
@@ skipping 1177 matching lines @@
     const Immediate& raw_null =
         Immediate(reinterpret_cast<intptr_t>(Object::null()));
 
     // EAX: new object start.
     // EBX: next object start.
     // EDI: new object type arguments (if is_cls_parameterized).
     // First try inlining the initialization without a loop.
     if (instance_size < (kInlineInstanceSize * kWordSize)) {
       // Check if the object contains any non-header fields.
       // Small objects are initialized using a consecutive set of writes.
-      for (intptr_t current_offset = sizeof(RawObject);
+      for (intptr_t current_offset = Instance::NextFieldOffset();
            current_offset < instance_size;
            current_offset += kWordSize) {
         __ movl(Address(EAX, current_offset), raw_null);
       }
     } else {
-      __ leal(ECX, Address(EAX, sizeof(RawObject)));
+      __ leal(ECX, Address(EAX, Instance::NextFieldOffset()));
       // Loop until the whole object is initialized.
       // EAX: new object.
       // EBX: next object start.
       // ECX: next word to be initialized.
       // EDI: new object type arguments (if is_cls_parameterized).
       Label init_loop;
       Label done;
       __ Bind(&init_loop);
       __ cmpl(ECX, EBX);
       __ j(ABOVE_EQUAL, &done, Assembler::kNearJump);
@@ skipping 993 matching lines @@
   GenerateIdenticalWithNumberCheckStub(assembler, left, right, temp);
   __ popl(temp);
   __ popl(right);
   __ popl(left);
   __ ret();
 }
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_IA32