Fix property array length calculation in TransformPropertiesToFastFor.
Fix property array length calculation in TransformPropertiesToFastFor.

It was silently assumed that inobject_properties value is not too large.
Recent introduction of inobject slack tracking made the assumption false
and debug tests with no snapshot failed.

Review URL: http://codereview.chromium.org/3584004

git-svn-id: b158db1e4b4ab85d4c9e510fdef4b1e8c614b15b@5575 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

UniversalFuture/moosh,UniversalFuture/moosh,UniversalFuture/moosh,UniversalFuture/moosh