[turbofan] Fix length in LowerJSCreateLiteralObject.

[turbofan] Fix length in LowerJSCreateLiteralObject.

This fixes the length computation in for object literals in generic
lowering. In rare cases (e.g. boilerplate at end of page) this could
lead to out of bounds reads.

R=bmeurer@chromium.org

Committed: https://crrev.com/db8f0504b819eed060a7c6fa26e71032f892dc47
Cr-Commit-Position: refs/heads/master@{#34328}

[Michael Starzinger, 2016-02-26 13:13:54]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2016-02-26 13:14:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1737893003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1737893003/1

[commit-bot: I haz the power, 2016-02-26 13:14:01]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-02-26 13:14:02]

No L-G-T-M from a valid reviewer yet. 
CQ run can only be started by full committers or once the patch has
received an L-G-T-M from a full committer.
Even if an L-G-T-M may have been provided, it was from a non-committer,
_not_ a full super star committer.
Committers are members of the group "project-v8-committers".
Note that this has nothing to do with OWNERS files.

[Benedikt Meurer, 2016-02-26 13:14:30]

lgtm

[Michael Starzinger, 2016-02-26 13:22:08]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2016-02-26 13:22:19]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1737893003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1737893003/1

[commit-bot: I haz the power, 2016-02-26 13:23:46]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-02-26 13:25:05]

Description was changed from

==========
[turbofan] Fix length in LowerJSCreateLiteralObject.

This fixes the length computation in for object literals in generic
lowering. In rare cases (e.g. boilerplate at end of page) this could
lead to out of bounds reads.

R=bmeurer@chromium.org
==========

to

==========
[turbofan] Fix length in LowerJSCreateLiteralObject.

This fixes the length computation in for object literals in generic
lowering. In rare cases (e.g. boilerplate at end of page) this could
lead to out of bounds reads.

R=bmeurer@chromium.org

Committed: https://crrev.com/db8f0504b819eed060a7c6fa26e71032f892dc47
Cr-Commit-Position: refs/heads/master@{#34328}
==========

[commit-bot: I haz the power, 2016-02-26 13:25:06]

Patchset 1 (id:??) landed as
https://crrev.com/db8f0504b819eed060a7c6fa26e71032f892dc47
Cr-Commit-Position: refs/heads/master@{#34328}