More accurate usages of Heap::AdjustLiveBytes().

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index afcc84d606601d4f21d5d75fa611b3aa48bcac50..60dc0b7a8d7a67fe2b507e10e23e89f15e24e881 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1796,8 +1796,8 @@ void Factory::ReinitializeJSReceiver(Handle<JSReceiver> object,
 
   // Put in filler if the new object is smaller than the old.
   if (size_difference > 0) {
-    Address address = object->address() + map->instance_size();
-    heap->CreateFillerObjectAt(address, size_difference);
+    Address address = object->address();
+    heap->CreateFillerObjectAt(address + map->instance_size(), size_difference);
     heap->AdjustLiveBytes(address, -size_difference, Heap::FROM_MUTATOR);
   }