[json] use OrderedHashSet for replacer property list.

test/mjsunit/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 309 matching lines @@
 
 var singleton = [];
 var multiOccurrence = [singleton, singleton, singleton];
 TestStringify("[[],[],[]]", multiOccurrence);
 
 TestStringify('{"x":5,"y":6}', {x:5,y:6});
 assertEquals('{"x":5}', JSON.stringify({x:5,y:6}, ['x']));
 assertEquals('{\n "a": "b",\n "c": "d"\n}',
              JSON.stringify({a:"b",c:"d"}, null, 1));
 assertEquals('{"y":6,"x":5}', JSON.stringify({x:5,y:6}, ['y', 'x']));
+assertEquals('{"y":6,"x":5}', JSON.stringify({x:5,y:6}, ['y', 'x', 'x', 'y']));
 
 // toJSON get string keys.
 var checker = {};
 var array = [checker];
 checker.toJSON = function(key) { return 1 + key; };
 TestStringify('["10"]', array);
 
 // The gap is capped at ten characters if specified as string.
 assertEquals('{\n          "a": "b",\n          "c": "d"\n}',
               JSON.stringify({a:"b",c:"d"}, null,
@@ skipping 176 matching lines @@
 // Make sure a failed [[DefineProperty]] doesn't throw
 
 reviver = function(p, v) {
   Object.freeze(this);
   return p === "" ? v : 42;
 }
 assertEquals({a: 0, b: 1}, JSON.parse('{"a":0,"b":1}', reviver));
 
 reviver = (k, v) => (v === Infinity) ? "inf" : v;
 assertEquals('{"":"inf"}', JSON.stringify({"":Infinity}, reviver));