Handle boxed length in JSON stringify.

Handle boxed length in JSON stringify.

Here is the test that used to fail in Smi::cast:

JSON.stringify(new Array(4000000000));

I am not adding the test because it takes huge amount of time before it
runs out of memory.

R=verwaest@chromium.org
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=20898

[Yang, 2014-04-22 15:40:50]

On 2014/04/22 13:15:19, jarin wrote:

lgtm.

[Jarin, 2014-04-23 08:40:33]

Committed patchset #1 manually as r20898 (presubmit successful).