[JSON stringifier] Correctly load array elements.

test/mjsunit/regress/regress-crbug-554946.js

Index: test/mjsunit/regress/regress-crbug-554946.js
diff --git a/test/mjsunit/regress/regress-crbug-554946.js b/test/mjsunit/regress/regress-crbug-554946.js
new file mode 100644
index 0000000000000000000000000000000000000000..ab2e327295818ea0f89a9b7c46acf6218d8c680e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-554946.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [];
+var funky = {
+  toJSON: function() { array.length = 1; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[0] = funky;
+assertEquals('["funky",null,null,null,null,null,null,null,null,null]',
+             JSON.stringify(array));