ARM: Fix bug in r5252

Review URL: http://codereview.chromium.org/3123013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/codegen-arm.cc

@@ -4828,7 +4828,7 @@ class DeferredIsStringWrapperSafeForDefaultValueOf : public DeferredCode {
     // Calculate location of the first key name.
     __ add(map_result_,
            map_result_,
-           Operand(FixedArray::kHeaderSize +
+           Operand(FixedArray::kHeaderSize - kHeapObjectTag +
                    DescriptorArray::kFirstIndex * kPointerSize));
     // Loop through all the keys in the descriptor array. If one of these is the
     // symbol valueOf the result is false.