[JSON stringifier] reintroduce fast path with bail out to slow path.

test/mjsunit/regress/regress-crbug-554946.js

Index: test/mjsunit/regress/regress-crbug-554946.js
diff --git a/test/mjsunit/regress/regress-crbug-554946.js b/test/mjsunit/regress/regress-crbug-554946.js
index ab2e327295818ea0f89a9b7c46acf6218d8c680e..2876da6c80159a5bad0029108a12a39b6e7f1feb 100644
--- a/test/mjsunit/regress/regress-crbug-554946.js
+++ b/test/mjsunit/regress/regress-crbug-554946.js
@@ -10,3 +10,12 @@ for (var i = 0; i < 10; i++) array[i] = i;
 array[0] = funky;
 assertEquals('["funky",null,null,null,null,null,null,null,null,null]',
              JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { array.length = 1; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},null,null,null,null,null,null]',
+             JSON.stringify(array));