Fix off-by-one error introduced in r12598.

src/json-parser.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 562 matching lines @@
     uc32 c0 = c0_;
     do {
       if (c0 == '\\') {
         return SlowScanJsonString<SeqAsciiString, char>(source_,
                                                         position_,
                                                         position);
       }
       if (c0_ < 0x20) return Handle<String>::null();
       running_hash = StringHasher::AddCharacterCore(running_hash, c0);
       position++;
-      if (position > source_length_) return Handle<String>::null();
+      if (position >= source_length_) return Handle<String>::null();
       c0 = seq_source_->SeqAsciiStringGet(position);
     } while (c0 != '"');
     int length = position - position_;
     uint32_t hash = (length <= String::kMaxHashCalcLength)
         ? StringHasher::GetHashCore(running_hash) : length;
     Vector<const char> string_vector(
         seq_source_->GetChars() + position_, length);
     SymbolTable* symbol_table = isolate()->heap()->symbol_table();
     uint32_t capacity = symbol_table->Capacity();
     uint32_t index = SymbolTable::FirstProbe(hash, capacity);
@@ skipping 48 matching lines @@
   }
   ASSERT_EQ('"', c0_);
   // Advance past the last '"'.
   AdvanceSkipWhitespace();
   return result;
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_PARSER_H_