Fix the upcall's off-by-1 bug.

Change-Id: I1405b887e34473a2c453889a05a22b17ed27c571
diff --git a/src/jni_internal_arm.cc b/src/jni_internal_arm.cc
index 6b4162b..99b4dc3 100644
--- a/src/jni_internal_arm.cc
+++ b/src/jni_internal_arm.cc
@@ -67,8 +67,8 @@
     __ LoadFromOffset(kLoadWord, IP, R3, r3_offset);
 
     // we're displaced off of the arguments by the spill space for the incoming
-    // arguments and the Method*
-    int sp_offset = reg_bytes + kPointerSize + off;
+    // arguments, the Method* and possibly the receiver
+    int sp_offset = reg_bytes + (method->IsStatic() ? 1 : 2) * kPointerSize + off;
     __ StoreToOffset(kStoreWord, IP, SP, sp_offset);
   }