Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/freelist.h

Index: runtime/vm/freelist.h
diff --git a/runtime/vm/freelist.h b/runtime/vm/freelist.h
index 4c48c5390dc9faba65aeff86af401294a211e669..3830f73a7ecedccc69b61576da3d4b547e6fa082 100644
--- a/runtime/vm/freelist.h
+++ b/runtime/vm/freelist.h
@@ -21,29 +21,40 @@ namespace dart {
 class FreeListElement {
  public:
   FreeListElement* next() const {
-    // Clear the FreeBit.
-    ASSERT((next_ & 1) == 1);
-    return reinterpret_cast<FreeListElement*>(next_ ^ 1);
+    return next_;
   }
+
   void set_next(FreeListElement* next) {
-    // Set the FreeBit.
-    uword addr = reinterpret_cast<uword>(next);
-    ASSERT((addr & 1) == 0);
-    next_ = addr | 1;
+    next_ = next;
   }
 
-  intptr_t size() const {
-    return size_;
+  intptr_t Size() {
+    intptr_t size = RawObject::SizeTag::decode(tags_);
+    if (size != 0) return size;
+    return *SizeAddress();
   }
 
   static FreeListElement* AsElement(uword addr, intptr_t size);
 
   static void InitOnce();
 
+  static RawClass* element_class() {
+    return element_class_;
+  }
+
  private:
   // This layout mirrors the layout of RawObject.
-  uword next_;
-  intptr_t size_;
+  uword tags_;
+  FreeListElement* next_;
+
+  // Returns the address of the embedded size.
+  intptr_t* SizeAddress() const {
+    uword addr = reinterpret_cast<uword>(&next_) + kWordSize;
+    return reinterpret_cast<intptr_t*>(addr);
+  }
+
+  // Fake class corresponding to kFreeListElement class id.
+  static RawClass* element_class_;
 
   // FreeListElements cannot be allocated. Instead references to them are
   // created using the AsElement factory method.