Out of bounds memory access in TestJSArrayForAllocationSiteInfo.

src/arm/macro-assembler-arm.cc

Index: src/arm/macro-assembler-arm.cc
diff --git a/src/arm/macro-assembler-arm.cc b/src/arm/macro-assembler-arm.cc
index ffa25eb60efc819ce6db15ff48530ed648a58858..7f641a7ae395b271101c14851e6dee2073fbb64a 100644
--- a/src/arm/macro-assembler-arm.cc
+++ b/src/arm/macro-assembler-arm.cc
@@ -3889,12 +3889,12 @@ void MacroAssembler::TestJSArrayForAllocationSiteInfo(
   ExternalReference new_space_allocation_top =
       ExternalReference::new_space_allocation_top_address(isolate());
   ldr(scratch_reg, FieldMemOperand(receiver_reg,
-                                   JSArray::kSize + AllocationSiteInfo::kSize));
+      JSArray::kSize + AllocationSiteInfo::kSize - kHeapObjectTag));
   cmp(scratch_reg, Operand(new_space_start));
   b(lt, &no_info_available);
   cmp(scratch_reg, Operand(new_space_allocation_top));
-  b(hs, &no_info_available);
-  ldr(scratch_reg, MemOperand(scratch_reg, 0));
+  b(gt, &no_info_available);
+  ldr(scratch_reg, MemOperand(scratch_reg, -AllocationSiteInfo::kSize));
   cmp(scratch_reg,
       Operand(Handle<Map>(isolate()->heap()->allocation_site_info_map())));
   b(eq, allocation_info_present);