Allow property indexes to refer to slots inside the object header.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 256 matching lines @@
   LookupResult lookup(isolate_);
   object->LocalLookupRealNamedProperty(*key, &lookup);
   if (!lookup.IsProperty()) return factory_->undefined_value();
   switch (lookup.type()) {
     case NORMAL: {
       Object* value = lookup.holder()->GetNormalizedProperty(&lookup);
       ASSERT(!value->IsTheHole());
       return Handle<Object>(value, isolate_);
     }
     case FIELD: {
-      Object* value = lookup.holder()->FastPropertyAt(lookup.GetFieldIndex());
+      Object* value = lookup.holder()->FastPropertyAt(
+          lookup.GetFieldIndex().FieldIndex());
       ASSERT(!value->IsTheHole());
       return Handle<Object>(value, isolate_);
     }
     case CONSTANT_FUNCTION:
       return Handle<Object>(lookup.GetConstantFunction(), isolate_);
     default: {
       PropertyAttributes attr;
       return Object::GetProperty(object, object, &lookup, key, &attr);
     }
   }
@@ skipping 503 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_