JSON.stringify should handle the replacer before the space

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $jsonSerializeAdapter;
 
 (function(global, utils) {
 
 "use strict";
 
@@ skipping 165 matching lines @@
   }
   // Undefined or a callable object.
   return UNDEFINED;
 }
 
 
 function JSONStringify(value, replacer, space) {
   if (%_ArgumentsLength() == 1) {
     return %BasicJSONStringify(value);
   }
-  if (IS_OBJECT(space)) {
-    // Unwrap 'space' if it is wrapped
-    if (IS_NUMBER_WRAPPER(space)) {
-      space = $toNumber(space);
-    } else if (IS_STRING_WRAPPER(space)) {
-      space = $toString(space);
-    }
-  }
-  var gap;
-  if (IS_NUMBER(space)) {
-    space = MathMax(0, MathMin($toInteger(space), 10));
-    gap = %_SubString("          ", 0, space);
-  } else if (IS_STRING(space)) {
-    if (space.length > 10) {
-      gap = %_SubString(space, 0, 10);
-    } else {
-      gap = space;
-    }
-  } else {
-    gap = "";
-  }
   if (IS_ARRAY(replacer)) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
     var seen_properties = { __proto__: null };
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
       var v = replacer[i];
       var item;
       if (IS_STRING(v)) {
         item = v;
       } else if (IS_NUMBER(v)) {
         item = %_NumberToString(v);
       } else if (IS_STRING_WRAPPER(v) || IS_NUMBER_WRAPPER(v)) {
         item = $toString(v);
       } else {
         continue;
       }
       if (!seen_properties[item]) {
         property_list.push(item);
         seen_properties[item] = true;
       }
     }
     replacer = property_list;
   }
+  if (IS_OBJECT(space)) {
+    // Unwrap 'space' if it is wrapped
+    if (IS_NUMBER_WRAPPER(space)) {
+      space = $toNumber(space);
+    } else if (IS_STRING_WRAPPER(space)) {
+      space = $toString(space);
+    }
+  }
+  var gap;
+  if (IS_NUMBER(space)) {
+    space = MathMax(0, MathMin($toInteger(space), 10));
+    gap = %_SubString("          ", 0, space);
+  } else if (IS_STRING(space)) {
+    if (space.length > 10) {
+      gap = %_SubString(space, 0, 10);
+    } else {
+      gap = space;
+    }
+  } else {
+    gap = "";
+  }
   return JSONSerialize('', {'': value}, replacer, new InternalArray(), "", gap);
 }
 
 // -------------------------------------------------------------------
 
 %AddNamedProperty(GlobalJSON, symbolToStringTag, "JSON", READ_ONLY | DONT_ENUM);
 
 // Set up non-enumerable properties of the JSON object.
 utils.InstallFunctions(GlobalJSON, DONT_ENUM, [
   "parse", JSONParse,
   "stringify", JSONStringify
 ]);
 
 // -------------------------------------------------------------------
 // JSON Builtins
 
 $jsonSerializeAdapter = function(key, object) {
   var holder = {};
   holder[key] = object;
   // No need to pass the actual holder since there is no replacer function.
   return JSONSerialize(key, holder, UNDEFINED, new InternalArray(), "", "");
 }
 
 })