Compute next field offset correctly.

runtime/vm/snapshot.cc

Index: runtime/vm/snapshot.cc
===================================================================
--- runtime/vm/snapshot.cc	(revision 29811)
+++ runtime/vm/snapshot.cc	(working copy)
@@ -790,30 +790,39 @@
       ASSERT(!cls_.IsNull());
       instance_size = cls_.instance_size();
     }
-    intptr_t offset = Object::InstanceSize();
+    intptr_t next_field_offset = cls_.next_field_offset();
+    intptr_t type_argument_field_offset = cls_.type_arguments_field_offset();
+    ASSERT(next_field_offset > 0);
+    // Instance::NextFieldOffset() returns the offset of the first field in
+    // a Dart object.
+    intptr_t offset = Instance::NextFieldOffset();
     intptr_t result_cid = result->GetClassId();
-    while (offset < instance_size) {
+    while (offset < next_field_offset) {
       obj_ = ReadObjectRef();
       result->SetFieldAtOffset(offset, obj_);
-      if (kind_ == Snapshot::kMessage) {
+      if ((offset != type_argument_field_offset) &&
+          (kind_ == Snapshot::kMessage)) {
         // TODO(fschneider): Consider hoisting these lookups out of the loop.
         // This would involve creating a handle, since cls_ can't be reused
         // across the call to ReadObjectRef.
         cls_ = isolate()->class_table()->At(result_cid);
         array_ = cls_.OffsetToFieldMap();
         field_ ^= array_.At(offset >> kWordSizeLog2);
-        // Entries can be null because offset can be outside of instance fields
-        // due to rounded allocation size.
-        if (!field_.IsNull()) {
-          ASSERT(field_.Offset() == offset);
-          field_.UpdateGuardedCidAndLength(obj_);
-        }
+        ASSERT(!field_.IsNull());
+        ASSERT(field_.Offset() == offset);
+        field_.UpdateGuardedCidAndLength(obj_);
       }
       // TODO(fschneider): Verify the guarded cid and length for other kinds of
       // snapshot (kFull, kScript) with asserts.
       offset += kWordSize;
     }
     if (kind_ == Snapshot::kFull) {
+      // We create an uninitialized object in the case of full snapshots, so
+      // we need to initialize any remaining padding area with the Null object.
+      while (offset < instance_size) {
+        result->SetFieldAtOffset(offset, Object::null_object());
+        offset += kWordSize;
+      }
       result->SetCreatedFromSnapshot();
     } else if (result->IsCanonical()) {
       *result = result->CheckAndCanonicalize(NULL);
@@ -1387,9 +1396,9 @@
   CheckIfSerializable(cls);
 
   // Object is regular dart instance.
-  intptr_t instance_size =
-      cls->ptr()->instance_size_in_words_ << kWordSizeLog2;
-  ASSERT(instance_size != 0);
+  intptr_t next_field_offset =
+      cls->ptr()->next_field_offset_in_words_ << kWordSizeLog2;
+  ASSERT(next_field_offset > 0);
 
   // Write out the serialization header value for this object.
   WriteInlinedObjectHeader(object_id);
@@ -1404,8 +1413,10 @@
   WriteObjectImpl(cls);
 
   // Write out all the fields for the object.
-  intptr_t offset = Object::InstanceSize();
-  while (offset < instance_size) {
+  // Instance::NextFieldOffset() returns the offset of the first field in
+  // a Dart object.
+  intptr_t offset = Instance::NextFieldOffset();
+  while (offset < next_field_offset) {
     WriteObjectRef(*reinterpret_cast<RawObject**>(
         reinterpret_cast<uword>(raw->ptr()) + offset));
     offset += kWordSize;