Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/class_table.cc

Index: runtime/vm/class_table.cc
diff --git a/runtime/vm/class_table.cc b/runtime/vm/class_table.cc
index 9d14b20e81af7391a3c981a10ce1ab2e4e4802eb..309e76954644979af2ff1b613ba1c6bf37ae8562 100644
--- a/runtime/vm/class_table.cc
+++ b/runtime/vm/class_table.cc
@@ -4,6 +4,7 @@
 
 #include "vm/class_table.h"
 #include "vm/flags.h"
+#include "vm/freelist.h"
 #include "vm/object.h"
 #include "vm/raw_object.h"
 #include "vm/visitor.h"
@@ -18,6 +19,7 @@ ClassTable::ClassTable()
     capacity_ = initial_capacity_;
     table_ = reinterpret_cast<RawClass**>(
         calloc(capacity_, sizeof(RawClass*)));  // NOLINT
+    table_[kFreeListElement] = FreeListElement::element_class();
   } else {
     // Duplicate the class table from the VM isolate.
     ClassTable* vm_class_table = Dart::vm_isolate()->class_table();
@@ -27,6 +29,7 @@ ClassTable::ClassTable()
     for (intptr_t i = kObject; i < kInstance; i++) {
       table_[i] = vm_class_table->At(i);
     }
+    table_[kFreeListElement] = vm_class_table->At(kFreeListElement);
     table_[kNullClassId] = vm_class_table->At(kNullClassId);
     table_[kDynamicClassId] = vm_class_table->At(kDynamicClassId);
     table_[kVoidClassId] = vm_class_table->At(kVoidClassId);
@@ -69,7 +72,14 @@ void ClassTable::Register(const Class& cls) {
 
 void ClassTable::VisitObjectPointers(ObjectPointerVisitor* visitor) {
   ASSERT(visitor != NULL);
-  visitor->VisitPointers(reinterpret_cast<RawObject**>(&table_[0]), top_);
+  // Class stored at the index kFreeListElement is a fake object
+  // residing outside of the heap.  Do not visit it.

[Ivan Posva, 2012/06/08 07:19:20]

Does the FreeListElement class have to reside outside the heap? Since it is not
pointed to directly by the FreeListElements any longer we do not need to update
it in the free blocks if it was ever moved.

+  visitor->VisitPointers(
+    reinterpret_cast<RawObject**>(&table_[0]),
+    reinterpret_cast<RawObject**>(&table_[kFreeListElement - 1]));
+  visitor->VisitPointers(
+    reinterpret_cast<RawObject**>(&table_[kFreeListElement + 1]),
+    reinterpret_cast<RawObject**>(&table_[top_ - 1]));
 }