places: fix gc of place channels containing place channels

The bug was a kind of typo: using `&` where `%` was intended to
implement a counter wraparound.

This bug is an even more likely candidate to be resopnsible for the
occassional crashes from the DrRacket easter-egg test.

pkgs/racket-pkgs/racket-test/tests/racket/place-chmsg-gc.rkt

@@ -0,0 +1,17 @@
+#lang racket/base
+(require racket/place)
+
+;; Make sure that place channels waiting in a channel
+;; are kept properly. N should be large enough to trigger
+;; a master collection.
+
+(define N 10000)
+(define-values (i o) (place-channel))
+(for ([j N])
+  (define-values (i2 o2) (place-channel))
+  (place-channel-put i2 j)
+  (place-channel-put i o2))
+(for ([j N])
+  (unless (eq? j (place-channel-get (place-channel-get o)))
+    ;; just as likely to crash as get here
+    (error "failed")))

racket/src/racket/src/mzmark_place.inc

@@ -102,7 +102,7 @@ static int place_async_channel_val_MARK(void *p, struct NewGC *gc) {
       gcMARK2(SCHEME_CAR(pr), gc);
       pr = SCHEME_CDR(pr);
     }
-    j = ((j + 1) & sz);
+    j = ((j + 1) % sz);
   }
 
   return
@@ -127,7 +127,7 @@ static int place_async_channel_val_FIXUP(void *p, struct NewGC *gc) {
       gcFIXUP2(SCHEME_CAR(pr), gc);
       pr = SCHEME_CDR(pr);
     }
-    j = ((j + 1) & sz);
+    j = ((j + 1) % sz);
   }
 
   return

racket/src/racket/src/mzmarksrc.c

@@ -1601,7 +1601,7 @@ place_async_channel_val {
       gcMARK2(SCHEME_CAR(pr), gc);
       pr = SCHEME_CDR(pr);
     }
-    j = ((j + 1) & sz);
+    j = ((j + 1) % sz);
   }
 
  size: