This fixes the length computation in for object literals in generic
lowering. In rare cases (e.g. boilerplate at end of page) this could
lead to out of bounds reads.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1737893003

Cr-Commit-Position: refs/heads/master@{#34328}