[turbofan] Fix length in LowerJSCreateLiteralObject.

This fixes the length computation in for object literals in generic
lowering. In rare cases (e.g. boilerplate at end of page) this could
lead to out of bounds reads.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1737893003

Cr-Commit-Position: refs/heads/master@{#34328}

src/compiler/js-generic-lowering.cc

@@ -663,7 +663,8 @@ void JSGenericLowering::LowerJSCreateLiteralArray(Node* node) {
 void JSGenericLowering::LowerJSCreateLiteralObject(Node* node) {
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
   CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
-  int const length = Handle<FixedArray>::cast(p.constant())->length();
+  // Constants are pairs, see ObjectLiteral::properties_count().
+  int const length = Handle<FixedArray>::cast(p.constant())->length() / 2;
   node->InsertInput(zone(), 1, jsgraph()->SmiConstant(p.index()));
   node->InsertInput(zone(), 2, jsgraph()->HeapConstant(p.constant()));
   node->InsertInput(zone(), 3, jsgraph()->SmiConstant(p.flags()));