Use proper descriptors array when committing state to JSON object.

src/json-parser.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/json-parser.h"
 
 #include "src/char-predicates-inl.h"
 #include "src/conversions.h"
 #include "src/debug/debug.h"
 #include "src/factory.h"
@@ skipping 460 matching lines @@
 }
 
 template <bool seq_one_byte>
 void JsonParser<seq_one_byte>::CommitStateToJsonObject(
     Handle<JSObject> json_object, Handle<Map> map,
     ZoneList<Handle<Object> >* properties) {
   JSObject::AllocateStorageForMap(json_object, map);
   DCHECK(!json_object->map()->is_dictionary_map());
 
   DisallowHeapAllocation no_gc;
-  DescriptorArray* descriptors = map->instance_descriptors();
+  DescriptorArray* descriptors = json_object->map()->instance_descriptors();
   int length = properties->length();
   for (int i = 0; i < length; i++) {
     Handle<Object> value = (*properties)[i];
     // Initializing store.
     json_object->WriteToField(i, descriptors->GetDetails(i), *value);
   }
 }
 
 // Parse a JSON array. Position must be right at '['.
 template <bool seq_one_byte>
@@ skipping 312 matching lines @@
   AdvanceSkipWhitespace();
   return result;
 }
 
 // Explicit instantiation.
 template class JsonParser<true>;
 template class JsonParser<false>;
 
 }  // namespace internal
 }  // namespace v8