[JSON] call replacer function with correct holder in JSON.stringify

src/json-stringifier.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/json-stringifier.h"
 
 #include "src/conversions.h"
 #include "src/lookup.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
@@ skipping 194 matching lines @@
   // Call toJSON function.
   if (key->IsSmi()) key = factory()->NumberToString(key);
   Handle<Object> argv[] = {key};
   ASSIGN_RETURN_ON_EXCEPTION(isolate_, object,
                              Execution::Call(isolate_, fun, object, 1, argv),
                              Object);
   return scope.CloseAndEscape(object);
 }
 
 MaybeHandle<Object> JsonStringifier::ApplyReplacerFunction(
-    Handle<Object> object, Handle<Object> key) {
+    Handle<Object> value, Handle<Object> key, Handle<Object> initial_holder) {
   HandleScope scope(isolate_);
   if (key->IsSmi()) key = factory()->NumberToString(key);
-  Handle<Object> argv[] = {key, object};
-  Handle<JSReceiver> holder = CurrentHolder(object);
+  Handle<Object> argv[] = {key, value};
+  Handle<JSReceiver> holder = CurrentHolder(value, initial_holder);
   ASSIGN_RETURN_ON_EXCEPTION(
-      isolate_, object,
+      isolate_, value,
       Execution::Call(isolate_, replacer_function_, holder, 2, argv), Object);
-  return scope.CloseAndEscape(object);
+  return scope.CloseAndEscape(value);
 }
 
-Handle<JSReceiver> JsonStringifier::CurrentHolder(Handle<Object> value) {
+Handle<JSReceiver> JsonStringifier::CurrentHolder(
+    Handle<Object> value, Handle<Object> initial_holder) {
   int length = Smi::cast(stack_->length())->value();
   if (length == 0) {
     Handle<JSObject> holder =
         factory()->NewJSObject(isolate_->object_function());
-    JSObject::AddProperty(holder, factory()->empty_string(), value, NONE);
+    JSObject::AddProperty(holder, factory()->empty_string(), initial_holder,
+                          NONE);
     return holder;
   } else {
     FixedArray* elements = FixedArray::cast(stack_->elements());
     return Handle<JSReceiver>(JSReceiver::cast(elements->get(length - 1)),
                               isolate_);
   }
 }
 
 JsonStringifier::Result JsonStringifier::StackPush(Handle<Object> object) {
   StackLimitCheck check(isolate_);
@@ skipping 24 matching lines @@
 void JsonStringifier::StackPop() {
   int length = Smi::cast(stack_->length())->value();
   stack_->set_length(Smi::FromInt(length - 1));
 }
 
 template <bool deferred_string_key>
 JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
                                                     bool comma,
                                                     Handle<Object> key) {
   StackLimitCheck interrupt_check(isolate_);
+  Handle<Object> initial_value = object;
   if (interrupt_check.InterruptRequested() &&
       isolate_->stack_guard()->HandleInterrupts()->IsException(isolate_)) {
     return EXCEPTION;
   }
   if (object->IsJSReceiver()) {
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
         isolate_, object, ApplyToJsonFunction(object, key), EXCEPTION);
   }
   if (!replacer_function_.is_null()) {
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        isolate_, object, ApplyReplacerFunction(object, key), EXCEPTION);
+        isolate_, object, ApplyReplacerFunction(object, key, initial_value),
+        EXCEPTION);
   }
 
   if (object->IsSmi()) {
     if (deferred_string_key) SerializeDeferredKey(comma, key);
     return SerializeSmi(Smi::cast(*object));
   }
 
   switch (HeapObject::cast(*object)->map()->instance_type()) {
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
@@ skipping 412 matching lines @@
     if (object->IsOneByteRepresentationUnderneath()) {
       SerializeString_<uint8_t, uc16>(object);
     } else {
       SerializeString_<uc16, uc16>(object);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8