Use the PushIfAbsent function for the JSON stringify stack....

src/array.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 141 matching lines @@
     var result = %_FastAsciiArrayJoin(elements, "");
     if (!IS_UNDEFINED(result)) return result;
     return %StringBuilderConcat(elements, elements_length, '');
   } finally {
     // Make sure to pop the visited array no matter what happens.
     if (is_array) visited_arrays.pop();
   }
 }
 
 
-function ConvertToString(e) {
-  if (e == null) return '';
-  else return ToString(e);
+function ConvertToString(x) {
+  if (IS_STRING(x)) return x;
+  if (IS_NUMBER(x)) return %_NumberToString(x);
+  if (IS_BOOLEAN(x)) return x ? 'true' : 'false';
+  return (IS_NULL_OR_UNDEFINED(x)) ? '' : %ToString(%DefaultString(x));
 }
 
 
 function ConvertToLocaleString(e) {
-  if (e == null) {
-    return '';
-  } else {
-    // e_obj's toLocaleString might be overwritten, check if it is a function.
-    // Call ToString if toLocaleString is not a function.
-    // See issue 877615.
-    var e_obj = ToObject(e);
-    if (IS_FUNCTION(e_obj.toLocaleString))
-      return ToString(e_obj.toLocaleString());
-    else
-      return ToString(e);
-  }
+  // e_obj's toLocaleString might be overwritten, check if it is a function.
+  // Call ConvertToString if toLocaleString is not a function.
+  // See issue 877615.
+  var e_obj = ToObject(e);
+  if (IS_FUNCTION(e_obj.toLocaleString))
+    return ToString(e_obj.toLocaleString());
+  else
+    return ConvertToString(e);
 }
 
 
 // This function implements the optimized splice implementation that can use
 // special array operations to handle sparse arrays in a sensible fashion.
 function SmartSlice(array, start_i, del_count, len, deleted_elements) {
   // Move deleted elements to a new array (the return value from splice).
   // Intervals array can contain keys and intervals.  See comment in Concat.
   var intervals = %GetArrayKeys(array, start_i + del_count);
   var length = intervals.length;
@@ skipping 167 matching lines @@
     throw new $TypeError('Array.prototype.toString is not generic');
   }
   return Join(this, this.length, ',', ConvertToLocaleString);
 }
 
 
 function ArrayJoin(separator) {
   if (IS_UNDEFINED(separator)) {
     separator = ',';
   } else if (!IS_STRING(separator)) {
-    separator = ToString(separator);
+    separator = NonStringToString(separator);
   }
 
   var result = %_FastAsciiArrayJoin(this, separator);
   if (!IS_UNDEFINED(result)) return result;
 
-  var length = TO_UINT32(this.length);
-  return Join(this, length, separator, ConvertToString);
+  return Join(this, TO_UINT32(this.length), separator, ConvertToString);
 }
 
 
 // Removes the last element from the array and returns it. See
 // ECMA-262, section 15.4.4.6.
 function ArrayPop() {
   var n = TO_UINT32(this.length);
   if (n == 0) {
     this.length = n;
     return;
@@ skipping 785 matching lines @@
     "lastIndexOf", getFunction("lastIndexOf", ArrayLastIndexOf, 1),
     "reduce", getFunction("reduce", ArrayReduce, 1),
     "reduceRight", getFunction("reduceRight", ArrayReduceRight, 1)
   ));
 
   %FinishArrayPrototypeSetup($Array.prototype);
 }
 
 
 SetupArray();