Use a walking visitor to traverse JSObject structure.

test/mjsunit/big-array-literal.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 74 matching lines @@
 
 // The sizes to test.
 var sizes = [1, 2, 100, 200, 300];
 
 // Run the test.
 for (var i = 0; i < sizes.length; i++) {
   testLiteral(sizes[i], false);
   testLiteral(sizes[i], true);
 }
 
+
+function checkExpectedException(e) {
+  assertInstanceof(e, RangeError);
+  assertTrue(e.message.indexOf("Maximum call stack size exceeded") >= 0);
+}
+
+
 function testLiteralAndCatch(size) {
   var big_enough = false;
   try {
     testLiteral(size, false);
   } catch (e) {
+    checkExpectedException(e);
     big_enough = true;
   }
   try {
     testLiteral(size, true);
   } catch (e) {
+    checkExpectedException(e);
     big_enough = true;
   }
   return big_enough;
 }
 
 // Catch stack overflows.
 
 testLiteralAndCatch(1000) ||
 testLiteralAndCatch(20000) ||
 testLiteralAndCatch(200000);