Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/freelist.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef VM_FREELIST_H_
 #define VM_FREELIST_H_
 
 #include "platform/assert.h"
 #include "vm/allocation.h"
 #include "vm/raw_object.h"
 
 namespace dart {
 
-// FreeListElement describes a freelist element that has the same size
-// as the smallest raw object. It uses the class_ field to point to a fake map
-// to enable basic traversing of the heap and to identify the type of freelist
-// element. It reuses the second word of the raw object to keep a next_
+// FreeListElement describes a freelist element.  Smallest FreeListElement is
+// two words in size.  Second word of the raw object is used to keep a next_
 // pointer to chain elements of the list together. For objects larger than the
-// minimal object size, the size of the element is embedded in the element at
-// the address following the next_ field.
+// object size encodable in tags field, the size of the element is embedded in
+// the element at the address following the next_ field.
 class FreeListElement {
  public:
   FreeListElement* next() const {
-    // Clear the FreeBit.
-    ASSERT((next_ & 1) == 1);
-    return reinterpret_cast<FreeListElement*>(next_ ^ 1);
-  }
-  void set_next(FreeListElement* next) {
-    // Set the FreeBit.
-    uword addr = reinterpret_cast<uword>(next);
-    ASSERT((addr & 1) == 0);
-    next_ = addr | 1;
+    return next_;
   }
 
-  intptr_t size() const {
-    return size_;
+  void set_next(FreeListElement* next) {
+    next_ = next;
+  }
+
+  intptr_t Size() {
+    intptr_t size = RawObject::SizeTag::decode(tags_);
+    if (size != 0) return size;
+    return *SizeAddress();
   }
 
   static FreeListElement* AsElement(uword addr, intptr_t size);
 
   static void InitOnce();
 
+  // Used to allocate class for free list elements in Object::InitOnce.
+  class FakeInstance {
+   public:
+    static cpp_vtable vtable() { return 0; }
+    static intptr_t InstanceSize() { return 0; }
+    static const ObjectKind kInstanceKind = kFreeListElement;
+    static bool IsInstance() { return true; }

[Ivan Posva, 2012/06/08 12:50:20]

private:
  DISALLOW_ALLOCATION();
  DISALLOW_IMPLICIT_CONSTRUCTORS(FakeInstance);

[Vyacheslav Egorov (Google), 2012/06/08 12:58:27]

Did
 private:
  DISALLOW_ALLOCATION();
  DISALLOW_COPY_AND_ASSIGN(FakeInstance);

Default constructor is required by Class::New<FakeInstance>.

+  };
+
  private:
   // This layout mirrors the layout of RawObject.
-  uword next_;
-  intptr_t size_;
+  uword tags_;
+  FreeListElement* next_;
+
+  // Returns the address of the embedded size.
+  intptr_t* SizeAddress() const {
+    uword addr = reinterpret_cast<uword>(&next_) + kWordSize;
+    return reinterpret_cast<intptr_t*>(addr);
+  }
 
   // FreeListElements cannot be allocated. Instead references to them are
   // created using the AsElement factory method.
   DISALLOW_ALLOCATION();
   DISALLOW_IMPLICIT_CONSTRUCTORS(FreeListElement);
 };
 
 
 class FreeList {
  public:
@@ skipping 16 matching lines @@
   void SplitElementAfterAndEnqueue(FreeListElement* element, intptr_t size);
 
   FreeListElement* free_lists_[kNumLists + 1];
 
   DISALLOW_COPY_AND_ASSIGN(FreeList);
 };
 
 }  // namespace dart
 
 #endif  // VM_FREELIST_H_