[JSON stringifier] Reintroduce fast path with bail out to slow path.

test/mjsunit/regress/regress-crbug-554946.js

Index: test/mjsunit/regress/regress-crbug-554946.js
diff --git a/test/mjsunit/regress/regress-crbug-554946.js b/test/mjsunit/regress/regress-crbug-554946.js
index ab2e327295818ea0f89a9b7c46acf6218d8c680e..fbb79f61b0bac44782ed2bc70d7398a90c7d0e1e 100644
--- a/test/mjsunit/regress/regress-crbug-554946.js
+++ b/test/mjsunit/regress/regress-crbug-554946.js
@@ -10,3 +10,52 @@ for (var i = 0; i < 10; i++) array[i] = i;
 array[0] = funky;
 assertEquals('["funky",null,null,null,null,null,null,null,null,null]',
              JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { array.length = 1; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},null,null,null,null,null,null]',
+             JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { array.pop(); return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,null]', JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { delete array[9]; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,null]', JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { delete array[6]; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,null,7,8,9]', JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { array[12] = 12; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,9]', JSON.stringify(array));
+
+array = [];
+funky = {
+  get value() { array[10000000] = 12; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,9]', JSON.stringify(array));