A bug allows JSObject literals with elements to have the elements in the boilerplate modified. BUG=466993 LOG=N Review URL: https://codereview.chromium.org/1037273002 Cr-Commit-Position: refs/heads/master@{#27511}