Out of bounds memory access in TestJSArrayForAllocationSiteInfo.

src/mips/macro-assembler-mips.cc

Index: src/mips/macro-assembler-mips.cc
diff --git a/src/mips/macro-assembler-mips.cc b/src/mips/macro-assembler-mips.cc
index 64f3631cebf356f3aa7a69fdcc5efaa4c2ecfd93..333d6309295f1cd1dec561c5c8ab73d87d2e230f 100644
--- a/src/mips/macro-assembler-mips.cc
+++ b/src/mips/macro-assembler-mips.cc
@@ -5455,11 +5455,11 @@ void MacroAssembler::TestJSArrayForAllocationSiteInfo(
   ExternalReference new_space_allocation_top =
       ExternalReference::new_space_allocation_top_address(isolate());
   lw(scratch_reg, FieldMemOperand(receiver_reg,
-                                  JSArray::kSize + AllocationSiteInfo::kSize));
+      JSArray::kSize + AllocationSiteInfo::kSize - kHeapObjecTag));
   Branch(&no_info_available, lt, scratch_reg, Operand(new_space_start));
-  Branch(&no_info_available, hs, scratch_reg,
+  Branch(&no_info_available, gt, scratch_reg,
       Operand(new_space_allocation_top));
-  lw(scratch_reg, MemOperand(scratch_reg));
+  lw(scratch_reg, MemOperand(scratch_reg, -AllocationSiteInfo::kSize));
   Branch(allocation_info_present, eq, scratch_reg,
       Operand(Handle<Map>(isolate()->heap()->allocation_site_info_map())));
   bind(&no_info_available);