[maglev] Fix OOB check for elements

Bug: v8:7700
Change-Id: I0eaf1ffaaa2d759226b675b367a58bc0ea9a5da2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3895813Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83196}

src/maglev/maglev-ir.cc

@@ -1412,9 +1412,8 @@ void CheckJSObjectElementsBounds::GenerateCode(MaglevAssembler* masm,
     __ CmpObjectType(object, FIRST_JS_OBJECT_TYPE, kScratchRegister);
     __ Assert(greater_equal, AbortReason::kUnexpectedValue);
   }
-  __ LoadAnyTaggedField(
-      kScratchRegister,
-      FieldOperand(object, JSReceiver::kPropertiesOrHashOffset));
+  __ LoadAnyTaggedField(kScratchRegister,
+                        FieldOperand(object, JSObject::kElementsOffset));
   if (FLAG_debug_code) {
     __ AssertNotSmi(kScratchRegister);
   }