[oilpan] LargeObject payload fix

No-try: true
Bug: chromium:853055, chromium:847679, chromium:852980
Change-Id: I019eea9d101cbd8e368607e6309a99b0e9779cc2
Reviewed-on: https://chromium-review.googlesource.com/1101605
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567561}

third_party/blink/renderer/platform/heap/heap_page.h

@@ -933,8 +933,7 @@ NO_SANITIZE_ADDRESS inline size_t HeapObjectHeader::PayloadSize() {
   size_t size = encoded_ & kHeaderSizeMask;
   if (UNLIKELY(size == kLargeObjectSizeInHeader)) {
     DCHECK(PageFromObject(this)->IsLargeObjectPage());
-    return static_cast<LargeObjectPage*>(PageFromObject(this))->PayloadSize() -
-           sizeof(HeapObjectHeader);
+    return static_cast<LargeObjectPage*>(PageFromObject(this))->PayloadSize();
   }
   DCHECK(!PageFromObject(this)->IsLargeObjectPage());
   return size - sizeof(HeapObjectHeader);