Use function wrapper argument to expose internal arrays to native scripts.

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $jsonSerializeAdapter;
 
 (function(global, shared, exports) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalJSON = global.JSON;
+var InternalArray = shared.InternalArray;
 
 // -------------------------------------------------------------------
 
 function Revive(holder, name, reviver) {
   var val = holder[name];
   if (IS_OBJECT(val)) {
     if (IS_ARRAY(val)) {
       var length = val.length;
       for (var i = 0; i < length; i++) {
         var newElement = Revive(val, %_NumberToString(i), reviver);
@@ skipping 209 matching lines @@
 // JSON Builtins
 
 $jsonSerializeAdapter = function(key, object) {
   var holder = {};
   holder[key] = object;
   // No need to pass the actual holder since there is no replacer function.
   return JSONSerialize(key, holder, UNDEFINED, new InternalArray(), "", "");
 }
 
 })