MIPS: Fix a bug in MacroAssembler::CheckFastElements.

This fixes 3 mjsunit tests when running with --stress-opt: object-freeze,
object-prevent-extensions, object-seal.

Original commit was 54ce3d60 (r8176).

BUG=
TEST=

Review URL: http://codereview.chromium.org//7236024
Patch from Paul Lind <plind44@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/mips/macro-assembler-mips.cc

@@ -2657,9 +2657,8 @@ void MacroAssembler::CheckFastElements(Register map,
                                        Register scratch,
                                        Label* fail) {
   STATIC_ASSERT(JSObject::FAST_ELEMENTS == 0);
-  lbu(scratch, FieldMemOperand(map, Map::kBitField2Offset));
-  And(scratch, scratch, Operand(Map::kMaximumBitField2FastElementValue));
-  Branch(fail, hi, scratch, Operand(zero_reg));
+  lbu(scratch, FieldMemOperand(map, Map::kInstanceTypeOffset));
+  Branch(fail, hi, scratch, Operand(Map::kMaximumBitField2FastElementValue));
 }