[JSON] call replacer function with correct holder in JSON.stringify

test/mjsunit/json-stringify-holder.js

Index: test/mjsunit/json-stringify-holder.js
diff --git a/test/mjsunit/json-stringify-holder.js b/test/mjsunit/json-stringify-holder.js
new file mode 100644
index 0000000000000000000000000000000000000000..542be5960252c0f36dcf08ed9ca16461667e222c
--- /dev/null
+++ b/test/mjsunit/json-stringify-holder.js
@@ -0,0 +1,83 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testBasic() {
+  var stack = [];
+  var object = {a: false};
+  var replaced = {a: false, replaced: true};
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true}`, JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false } },
+      key: "",
+      value: { a: false }
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "replaced",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+})();
+
+(function testToJSON() {
+  var stack = [];
+  var object = {a: false, toJSON };
+  var replaced = {a: false, replaced: true};
+  var toJSONd = {a: false, toJSONd: true }
+
+  function toJSON(key, value) {
+    return toJSONd;
+  }
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true}`, JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false, toJSON: toJSON } },
+      key: "",
+      value: { a: false, toJSONd: true }
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "replaced",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[0].value, toJSONd);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+})();