Use the PushIfAbsent function for the JSON stringify stack....

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 48 matching lines @@
 
 function JSONParse(text, reviver) {
   var unfiltered = ParseJSONUnfiltered(text);
   if (IS_FUNCTION(reviver)) {
     return Revive({'': unfiltered}, '', reviver);
   } else {
     return unfiltered;
   }
 }
 
-function StackContains(stack, val) {
-  var length = stack.length;
-  for (var i = 0; i < length; i++) {
-    if (stack[i] === val) {
-      return true;
-    }
-  }
-  return false;
-}
-
 function SerializeArray(value, replacer, stack, indent, gap) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   var stepback = indent;
   indent += gap;
   var partial = [];
   var len = value.length;
   for (var i = 0; i < len; i++) {
     var strP = JSONSerialize($String(i), value, replacer, stack,
                              indent, gap);
     if (IS_UNDEFINED(strP)) {
       strP = "null";
     }
     partial.push(strP);
   }
   var final;
   if (gap == "") {
     final = "[" + partial.join(",") + "]";
   } else if (partial.length > 0) {
     var separator = ",\n" + indent;
     final = "[\n" + indent + partial.join(separator) + "\n" +
         stepback + "]";
   } else {
     final = "[]";
   }
   stack.pop();
   return final;
 }
 
 function SerializeObject(value, replacer, stack, indent, gap) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   var stepback = indent;
   indent += gap;
   var partial = [];
   if (IS_ARRAY(replacer)) {
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
       if (ObjectHasOwnProperty.call(replacer, i)) {
         var p = replacer[i];
         var strP = JSONSerialize(p, value, replacer, stack, indent, gap);
         if (!IS_UNDEFINED(strP)) {
@@ skipping 65 matching lines @@
       }
     case "number":
       return $isFinite(value) ? $String(value) : "null";
     case "boolean":
       return value ? "true" : "false";
   }
 }
 
 
 function BasicSerializeArray(value, stack, builder) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   builder.push("[");
   var len = value.length;
   for (var i = 0; i < len; i++) {
     var before = builder.length;
     BasicJSONSerialize(i, value, stack, builder);
     if (before == builder.length) builder.push("null");
     builder.push(",");
   }
   stack.pop();
   if (builder.pop() != ",") {
     builder.push("[]");  // Zero length array. Push "[" back on.
   } else {
     builder.push("]");
   }
 
 }
 
 
 function BasicSerializeObject(value, stack, builder) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   builder.push("{");
   for (var p in value) {
     if (%HasLocalProperty(value, p)) {
       builder.push(%QuoteJSONString(p));
       builder.push(":");
       var before = builder.length;
       BasicJSONSerialize(p, value, stack, builder);
       if (before == builder.length) {
         builder.pop();
         builder.pop();
@@ skipping 82 matching lines @@
 }
 
 function SetupJSON() {
   InstallFunctions($JSON, DONT_ENUM, $Array(
     "parse", JSONParse,
     "stringify", JSONStringify
   ));
 }
 
 SetupJSON();