[wasm] Fix heap sandbox compilation

This fixes an oversight in crrev.com/c/3277878.

Bug: v8:11510
Change-Id: I91b55682fd27c55ef556e919d7f04a9dbbecadea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3300137Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78072}

src/wasm/baseline/liftoff-compiler.cc

@@ -6072,7 +6072,7 @@ class LiftoffCompiler {
 
 #ifdef V8_HEAP_SANDBOX
       LOAD_INSTANCE_FIELD(temp.gp(), IsolateRoot, kSystemPointerSize, pinned);
-      __ LoadExternalPointer(target.gp(), func_data.gp(),
+      __ LoadExternalPointer(target.gp(), func_ref.gp(),
                              WasmInternalFunction::kForeignAddressOffset,
                              kForeignForeignAddressTag, temp.gp());
 #else