Allow property indexes to refer to slots inside the object header.

src/json-stringifier.h

Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index cdb724f0a867a37dffc7f55c401b727bdabaa343..086854ae8fd9660557fa7701918666f1cb392d4d 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -274,7 +274,8 @@ Handle<Object> BasicJsonStringifier::GetProperty(Handle<JSObject> object,
       return Handle<Object>(value, isolate_);
     }
     case FIELD: {
-      Object* value = lookup.holder()->FastPropertyAt(lookup.GetFieldIndex());
+      Object* value = lookup.holder()->FastPropertyAt(
+          lookup.GetFieldIndex().FieldIndex());
       ASSERT(!value->IsTheHole());
       return Handle<Object>(value, isolate_);
     }