[json] Use correct index to read details

Bug: chromium:963568
Change-Id: Icf0d1451dc4976fa18aa42a001d0f7312d3e9fcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615179
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61570}

src/json-parser.cc

@@ -493,7 +493,8 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
 
     Handle<Object> value = property.value;
 
-    PropertyDetails details = target->instance_descriptors()->GetDetails(i);
+    PropertyDetails details =
+        target->instance_descriptors()->GetDetails(descriptor);
     Representation expected_representation = details.representation();
 
     if (!value->FitsRepresentation(expected_representation)) {

test/mjsunit/regress/regress-crbug-963568.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+JSON.parse('{"0":true,"1":true,"2":true,"3":true,"4":true,"9":true," ":true,"D":true,"B":true,"-1":true,"A":true,"C":true}');
+JSON.parse('{"0":true,"1":true,"2":true,"3":true,"4":true,"9":true," ":true,"D":true,"B":true,"-1":true,"A":true,"C":true}');