Fix a pretty blatant GC bug (was the cause of all the weird crashes on windows).

vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
@@ skipping 8583 matching lines @@
   }
   ASSERT(Length() < Capacity());
   intptr_t index = Length();
   SetLength(index + 1);
   contents.SetAt(index, value);
 }
 
 
 void GrowableObjectArray::Grow(intptr_t new_capacity, Heap::Space space) const {
   ASSERT(new_capacity > Capacity());
-  Array& contents = Array::Handle(data());
-  StorePointer(&(raw_ptr()->data_),
-               Array::Grow(contents, new_capacity, space));
+  const Array& contents = Array::Handle(data());
+  const Array& new_contents =
+      Array::Handle(Array::Grow(contents, new_capacity, space));
+  StorePointer(&(raw_ptr()->data_), new_contents.raw());
 }
 
 
 RawObject* GrowableObjectArray::RemoveLast() const {
   ASSERT(!IsNull());
   ASSERT(Length() > 0);
   intptr_t index = Length() - 1;
   const Array& contents = Array::Handle(data());
   const Object& obj = Object::Handle(contents.At(index));
   contents.SetAt(index, Object::Handle());
@@ skipping 514 matching lines @@
   const String& str = String::Handle(pattern());
   const char* format = "JSRegExp: pattern=%s flags=%s";
   intptr_t len = OS::SNPrint(NULL, 0, format, str.ToCString(), Flags());
   char* chars = reinterpret_cast<char*>(
       Isolate::Current()->current_zone()->Allocate(len + 1));
   OS::SNPrint(chars, (len + 1), format, str.ToCString(), Flags());
   return chars;
 }
 
 }  // namespace dart