URK!  when scanning the heap we might find a DEAD_WEAK that either (a)
is the size of a WEAK, because we just overwrote its info table, or
(b) is the size of a DEAD_WEAK, because its been around at least one
GC.  The code herein only accounted for case (a).

Fix: check the word at location p+sizeof(DEAD_WEAK), see whether it
looks like an info table ptr, and if so we're in case (b).  This is
guaranteed to work, because we know that in case (a) the appropriate
word will be a closure pointer.