Fix the reviver function in JSON.parse

test/mjsunit/regress/regress-3136.js

Index: test/mjsunit/regress/regress-3136.js
diff --git a/test/mjsunit/context-variable-assignments.js b/test/mjsunit/regress/regress-3136.js
similarity index 88%
copy from test/mjsunit/context-variable-assignments.js
copy to test/mjsunit/regress/regress-3136.js
index 930b969609b5974f2c2ed46ab79610f575a171fd..41ed1c8056b24aad0675597e9b3d08fcfdf63e48 100644
--- a/test/mjsunit/context-variable-assignments.js
+++ b/test/mjsunit/regress/regress-3136.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,13 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-function foo() {
-  var a, b;
-  var bar = function() {
-    a = b = "hello world";
+function reviver(p, v) {
+  if (p == 0) {
+    this.length = 0;
   }
-  bar();
-  return a;
+  return v;
 }
 
-assertEquals("hello world", foo());
+var len = JSON.parse("[1,2,3]", reviver).length
+assertEquals(1, len);