Correctly set the length of string before creating filler object in the json parser (fixes crbug ...

src/json-parser.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 435 matching lines @@
   if (isolate()->heap()->InNewSpace(*seq_two_byte)) {
     isolate()->heap()->new_space()->
           ShrinkStringAtAllocationBoundary<SeqTwoByteString>(*seq_two_byte,
                                                              count);
   } else {
     int string_size = SeqTwoByteString::SizeFor(count);
     int allocated_string_size =
         SeqTwoByteString::SizeFor(kInitialSpecialStringSize * allocation_count);
     int delta = allocated_string_size - string_size;
     Address start_filler_object = seq_two_byte->address() + string_size;
+    seq_two_byte->set_length(count);
     isolate()->heap()->CreateFillerObjectAt(start_filler_object, delta);
   }
   string_val_ = isolate()->factory()->NewConsString(ascii, seq_two_byte);
   return Token::STRING;
 }
 
 
 Token::Value JsonParser::ScanJsonString() {
   ASSERT_EQ('"', c0_);
   // Set string_val to null. If string_val is not set we assume an
@@ skipping 37 matching lines @@
     return isolate()->factory()->LookupAsciiSymbol(seq_source_,
                                                    current_.beg_pos + 1,
                                                    length);
   }
   // The current token includes the '"' in both ends.
   return  isolate()->factory()->NewSubString(
       source_, current_.beg_pos + 1, current_.end_pos - 1);
 }
 
 } }  // namespace v8::internal