[weakrefs] Fix typo when recording GC slot for dirty FinalizationRegistry tail

Bug: v8:8179, chromium:1074621
Change-Id: I5a5e01df1e91937451041cd945a8cc72868c175c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2166944Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67395}

src/heap/heap.cc

@@ -6126,10 +6126,9 @@ void Heap::EnqueueDirtyJSFinalizationRegistry(
     JSFinalizationRegistry tail = JSFinalizationRegistry::cast(
         dirty_js_finalization_registries_list_tail());
     tail.set_next_dirty(finalization_registry);
-    gc_notify_updated_slot(tail,
-                           finalization_registry.RawField(
-                               JSFinalizationRegistry::kNextDirtyOffset),
-                           finalization_registry);
+    gc_notify_updated_slot(
+        tail, tail.RawField(JSFinalizationRegistry::kNextDirtyOffset),
+        finalization_registry);
   }
   set_dirty_js_finalization_registries_list_tail(finalization_registry);
   // dirty_js_finalization_registries_list_tail_ is rescanned by