We were scanning the wrong number of bytes for conservative objects;
we were using the allocated size instead of the user size, but
starting the scan at the beginning of the user section.

Finally ran into a case where a conservative object was the very
last object in the heap and it segfaulted.