[json] Fix iteration over object keys in InternalizeJSONProperty.

src/js/json.js

Index: src/js/json.js
diff --git a/src/js/json.js b/src/js/json.js
index 73d7802be964164adb7611e5bc3b130ba7bfac5f..ddd081bab11bf7dfa5c0fcef7385c247e56443f3 100644
--- a/src/js/json.js
+++ b/src/js/json.js
@@ -51,7 +51,9 @@ function InternalizeJSONProperty(holder, name, reviver) {
         }
       }
     } else {
-      for (var p of %object_keys(val)) {
+      var keys = %object_keys(val);

[caitp (gmail), 2016/02/29 16:48:10]

I believe this is still observable, eg if accessors for Array elements are
installed on the prototype. the ObjectKeys() builtin returns a plain JSArray, so
accessors installed on Array.prototype will be invoked.

[caitp (gmail), 2016/02/29 17:01:09]

Okay, I guess accessors on the prototype don't matter here, since ObjectKeys()
looks at own properties only. S'all good :>

+      for (var i = 0; i < keys.length; i++) {
+        var p = keys[i];
         var newElement = InternalizeJSONProperty(val, p, reviver);
         if (IS_UNDEFINED(newElement)) {
           %reflect_delete_property(val, p);
@@ -122,7 +124,9 @@ function SerializeObject(value, replacer, stack, indent, gap) {
       }
     }
   } else {
-    for (var p of %object_keys(value)) {
+    var keys = %object_keys(value);
+    for (var i = 0; i < keys.length; i++) {
+      var p = keys[i];
       var strP = JSONSerialize(p, value, replacer, stack, indent, gap);
       if (!IS_UNDEFINED(strP)) {
         var member = %QuoteJSONString(p) + ":";