[json] Repair JSON.parse regression with non-sequential strings.

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins.h"
 
 #include "src/api-arguments.h"
 #include "src/api-natives.h"
 #include "src/api.h"
 #include "src/base/once.h"
@@ skipping 2233 matching lines @@
 }
 
 // ES6 section 24.3.1 JSON.parse.
 BUILTIN(JsonParse) {
   HandleScope scope(isolate);
   Handle<Object> source = args.atOrUndefined(isolate, 1);
   Handle<Object> reviver = args.atOrUndefined(isolate, 2);
   Handle<String> string;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, string,
                                      Object::ToString(isolate, source));
+  string = String::Flatten(string);
   RETURN_RESULT_OR_FAILURE(
       isolate, string->IsSeqOneByteString()
                    ? JsonParser<true>::Parse(isolate, string, reviver)
                    : JsonParser<false>::Parse(isolate, string, reviver));
 }
 
 // ES6 section 24.3.2 JSON.stringify.
 BUILTIN(JsonStringify) {
   HandleScope scope(isolate);
   JsonStringifier stringifier(isolate);
@@ skipping 3541 matching lines @@
 BUILTIN_LIST_T(DEFINE_BUILTIN_ACCESSOR_T)
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 #undef DEFINE_BUILTIN_ACCESSOR_T
 #undef DEFINE_BUILTIN_ACCESSOR_H
 
 }  // namespace internal
 }  // namespace v8