ARM: Fix bug in r5252

Review URL: http://codereview.chromium.org/3123013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm/codegen-arm.cc b/src/arm/codegen-arm.cc
index a7e4c0475aee94aa2743ccf129d632a45446d8bd..214b3bc434496d5c94ef196853d08159bf3d3c49 100644 (file)
--- a/src/arm/codegen-arm.cc
+++ b/src/arm/codegen-arm.cc
@@ -4828,7 +4828,7 @@ class DeferredIsStringWrapperSafeForDefaultValueOf : public DeferredCode {
     // Calculate location of the first key name.
     __ add(map_result_,
            map_result_,
-           Operand(FixedArray::kHeaderSize +
+           Operand(FixedArray::kHeaderSize - kHeapObjectTag +
                    DescriptorArray::kFirstIndex * kPointerSize));
     // Loop through all the keys in the descriptor array. If one of these is the
     // symbol valueOf the result is false.