Use the PushIfAbsent function for the JSON stringify stack....

src/json.js

Index: src/json.js
===================================================================
--- src/json.js	(revision 5940)
+++ src/json.js	(working copy)
@@ -66,21 +66,10 @@
   }
 }
 
-function StackContains(stack, val) {
-  var length = stack.length;
-  for (var i = 0; i < length; i++) {
-    if (stack[i] === val) {
-      return true;
-    }
-  }
-  return false;
-}
-
 function SerializeArray(value, replacer, stack, indent, gap) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   var stepback = indent;
   indent += gap;
   var partial = [];
@@ -108,10 +97,9 @@
 }
 
 function SerializeObject(value, replacer, stack, indent, gap) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   var stepback = indent;
   indent += gap;
   var partial = [];
@@ -197,10 +185,9 @@
 
 
 function BasicSerializeArray(value, stack, builder) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   builder.push("[");
   var len = value.length;
   for (var i = 0; i < len; i++) {
@@ -220,10 +207,9 @@
 
 
 function BasicSerializeObject(value, stack, builder) {
-  if (StackContains(stack, value)) {
+  if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', []);
   }
-  stack.push(value);
   builder.push("{");
   for (var p in value) {
     if (%HasLocalProperty(value, p)) {