Do not reuse tags_ field to store next_ pointer of FreeListElement.

runtime/vm/object.cc

Index: runtime/vm/object.cc
diff --git a/runtime/vm/object.cc b/runtime/vm/object.cc
index 2d2d5f14e2214847322f512b197fb1bda161cc22..990f9114d877726e7f80d1f87ca4a05e49826114 100644
--- a/runtime/vm/object.cc
+++ b/runtime/vm/object.cc
@@ -299,6 +299,10 @@ void Object::InitOnce() {
   cls.set_is_finalized();
   null_class_ = cls.raw();
 
+  // Allocate and initialize the free list element class.
+  cls = Class::New<FreeListElement::FakeInstance>(kFreeListElement);
+  cls.set_is_finalized();
+
   // Allocate and initialize the sentinel values of Null class.
   {
     cls = null_class_;