Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
@@ skipping 281 matching lines @@
     cls.raw_ptr()->num_native_fields_ = 0;
     cls.InitEmptyFields();
     Isolate::Current()->class_table()->Register(cls);
   }
 
   // Allocate and initialize the null class.
   cls = Class::New<Instance>(kNullClassId);
   cls.set_is_finalized();
   null_class_ = cls.raw();
 
+  // Allocate and initialize the free list element class.
+  cls = Class::New<FreeListElement::FakeInstance>(kFreeListElement);
+  cls.set_is_finalized();
+
   // Allocate and initialize the sentinel values of Null class.
   {
     cls = null_class_;
     Instance& sentinel = Instance::Handle();
     sentinel ^= Object::Allocate(cls, Instance::InstanceSize(), Heap::kOld);
     sentinel_ = sentinel.raw();
 
     Instance& transition_sentinel = Instance::Handle();
     transition_sentinel ^=
         Object::Allocate(cls, Instance::InstanceSize(), Heap::kOld);
@@ skipping 9797 matching lines @@
   const String& str = String::Handle(pattern());
   const char* format = "JSRegExp: pattern=%s flags=%s";
   intptr_t len = OS::SNPrint(NULL, 0, format, str.ToCString(), Flags());
   char* chars = reinterpret_cast<char*>(
       Isolate::Current()->current_zone()->Allocate(len + 1));
   OS::SNPrint(chars, (len + 1), format, str.ToCString(), Flags());
   return chars;
 }
 
 }  // namespace dart