[json] fix encoding change for two-byte gap strings.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_JSON_STRINGIFIER_H_
 #define V8_JSON_STRINGIFIER_H_
 
 #include "src/conversions.h"
 #include "src/lookup.h"
 #include "src/messages.h"
@@ skipping 180 matching lines @@
     "\364\0      \365\0      \366\0      \367\0      "
     "\370\0      \371\0      \372\0      \373\0      "
     "\374\0      \375\0      \376\0      \377\0      ";
 
 BasicJsonStringifier::BasicJsonStringifier(Isolate* isolate, Handle<String> gap)
     : isolate_(isolate), builder_(isolate), gap_string_(gap), indent_(0) {
   tojson_string_ = factory()->toJSON_string();
   stack_ = factory()->NewJSArray(8);
   int gap_length = gap->length();
   if (gap_length != 0) {
-    String::Flatten(gap);
+    gap = String::Flatten(gap);
+    if (gap->IsTwoByteRepresentation()) builder_.ChangeEncoding();
     DisallowHeapAllocation no_gc;
     String::FlatContent flat = gap->GetFlatContent();
     gap_ = NewArray<uc16>(gap_length + 1);
     if (flat.IsOneByte()) {
       CopyChars(gap_, flat.ToOneByteVector().start(), gap_length);
     } else {
       CopyChars(gap_, flat.ToUC16Vector().start(), gap_length);
-      builder_.ChangeEncoding();
     }
     gap_[gap_length] = '\0';
   } else {
     gap_ = nullptr;
   }
 }
 
 
 MaybeHandle<Object> BasicJsonStringifier::Stringify(Handle<Object> object) {
   Result result = SerializeObject(object);
@@ skipping 521 matching lines @@
     } else {
       SerializeString_<uc16, uc16>(object);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_JSON_STRINGIFIER_H_