Push version 1.3.4 to trunk....

test/mjsunit/json.js

Index: test/mjsunit/json.js
===================================================================
--- test/mjsunit/json.js	(revision 2677)
+++ test/mjsunit/json.js	(working copy)
@@ -195,3 +195,13 @@
 
 assertEquals(undefined, JSON.stringify(undefined));
 assertEquals(undefined, JSON.stringify(function () { }));
+
+function checkIllegal(str) {
+  assertThrows(function () { JSON.parse(str); }, SyntaxError);
+}
+
+checkIllegal('1); throw "foo"; (1');
+
+var x = 0;
+eval("(1); x++; (1)");
+checkIllegal('1); x++; (1');