Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/freelist.cc

Index: runtime/vm/freelist.cc
diff --git a/runtime/vm/freelist.cc b/runtime/vm/freelist.cc
index a88a948641e3e8bb9e7fd79fd8a7811dfbabfc69..959607e94eef99183345725f3aba5ea20348b8b1 100644
--- a/runtime/vm/freelist.cc
+++ b/runtime/vm/freelist.cc
@@ -15,15 +15,25 @@ FreeListElement* FreeListElement::AsElement(uword addr, intptr_t size) {
   ASSERT(Utils::IsAligned(size, kObjectAlignment));
 
   FreeListElement* result = reinterpret_cast<FreeListElement*>(addr);
-  result->size_ = size;
+
+  uword tags = 0;
+  tags = RawObject::FreeBit::update(true, tags);
+  tags = RawObject::SizeTag::update(size, tags);
+  tags = RawObject::ClassIdTag::update(kFreeListElement, tags);
+
+  result->tags_ = tags;
+  if (size > RawObject::SizeTag::kMaxSizeTag) {
+    *result->SizeAddress() = size;
+  }
   result->set_next(NULL);
+
   return result;
 }
 
 
 void FreeListElement::InitOnce() {
   ASSERT(sizeof(FreeListElement) == kObjectAlignment);
-  ASSERT(OFFSET_OF(FreeListElement, next_) == Object::tags_offset());
+  ASSERT(OFFSET_OF(FreeListElement, tags_) == Object::tags_offset());
 }
 
 
@@ -60,7 +70,7 @@ uword FreeList::TryAllocate(intptr_t size) {
   FreeListElement* previous = NULL;
   FreeListElement* current = free_lists_[kNumLists];
   while (current != NULL) {
-    if (current->size() >= size) {
+    if (current->Size() >= size) {
       // Found an element large enough to hold the requested size. Dequeue,
       // split and enqueue the remainder.
       if (previous == NULL) {
@@ -118,7 +128,7 @@ FreeListElement* FreeList::DequeueElement(intptr_t index) {
 
 void FreeList::SplitElementAfterAndEnqueue(FreeListElement* element,
                                            intptr_t size) {
-  intptr_t remainder_size = element->size() - size;
+  intptr_t remainder_size = element->Size() - size;
   if (remainder_size == 0) return;
 
   element = FreeListElement::AsElement(reinterpret_cast<uword>(element) + size,