Use proper descriptors array when committing state to JSON object.

This CL fixes an issue introduced in https://codereview.chromium.org/2645083003.

BUG=chromium:683818

Review-Url: https://codereview.chromium.org/2651653002
Cr-Commit-Position: refs/heads/master@{#42602}

src/json-parser.cc

@@ -478,7 +478,7 @@ void JsonParser<seq_one_byte>::CommitStateToJsonObject(
   DCHECK(!json_object->map()->is_dictionary_map());
 
   DisallowHeapAllocation no_gc;
-  DescriptorArray* descriptors = map->instance_descriptors();
+  DescriptorArray* descriptors = json_object->map()->instance_descriptors();
   int length = properties->length();
   for (int i = 0; i < length; i++) {
     Handle<Object> value = (*properties)[i];