Port 7c347c54

Original commit message:
A bug allows JSObject literals with elements to have the elements in the
boilerplate modified.

R=mbrandy@us.ibm.com

BUG=466993
LOG=N

Review URL: https://codereview.chromium.org/1046223002

Cr-Commit-Position: refs/heads/master@{#27552}