JSON.parse: properly deal with reviver result

test/webkit/fast/js/JSON-parse-reviver.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions
 // are met:
 // 1.  Redistributions of source code must retain the above copyright
 //     notice, this list of conditions and the following disclaimer.
 // 2.  Redistributions in binary form must reproduce the above copyright
 //     notice, this list of conditions and the following disclaimer in the
@@ skipping 57 matching lines @@
             break;
 
         case 3:
             debug("");
             debug("Ensure that we visited a value that we have deleted, and that deletion is reflected while filtering.");
             shouldBeFalse("currentHolder.hasOwnProperty(3)");
             value = v;
             debug("");
             debug("Ensure that when visiting a deleted property value is undefined");
             shouldBeUndefined("value");
+            this.length = 3;
             v = "undelete the property";
-            expectedLength = this.length = 3;
+            expectedLength = 4;
             break;
 
         case 4:
-            if (this.length != 3) {
+            if (this.length != 4) {
                 testFailed("Did not call reviver for deleted property");
                 expectedLength = this.length = 3;
                 break;
             }
 
         case 5:
             testPassed("Ensured that property was visited despite Array length being reduced.");
             value = v;
             shouldBeUndefined("value");
             this[10] = "fail";
@@ skipping 100 matching lines @@
 var createdBadness = false;
 function reviveIntroducesNewArrayLikeObject(i, v) {
     if (i == 0 && !createdBadness) {
         this[1] = /(a)+/.exec("a");
         createdBadness = true;
     }
     return v;
 }
 
 shouldBe('JSON.stringify(JSON.parse("[0,1]", reviveIntroducesNewArrayLikeObject))', '\'[0,["a","a"]]\'');