Directly use %ObjectKeys in json stringify.

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 229 matching lines @@
   builder.push("]");
 }
 
 
 function BasicSerializeObject(value, stack, builder) {
   if (!%PushIfAbsent(stack, value)) {
     throw MakeTypeError('circular_structure', $Array());
   }
   builder.push("{");
   var first = true;
-  for (var p in value) {
-    if (%HasLocalProperty(value, p)) {
-      if (!first) {
-        builder.push(%QuoteJSONStringComma(p));
-      } else {
-        builder.push(%QuoteJSONString(p));
-      }
-      builder.push(":");
-      var before = builder.length;
-      BasicJSONSerialize(p, value[p], stack, builder);
-      if (before == builder.length) {
-        builder.pop();
-        builder.pop();
-      } else {
-        first = false;
-      }
+  var keys = %ObjectKeys(value);
+  var len = keys.length;
+  for (var i = 0; i < len; i++) {
+    var p = keys[i];
+    if (!first) {
+      builder.push(%QuoteJSONStringComma(p));
+    } else {
+      builder.push(%QuoteJSONString(p));
+    }
+    builder.push(":");
+    var before = builder.length;
+    BasicJSONSerialize(p, value[p], stack, builder);
+    if (before == builder.length) {
+      builder.pop();
+      builder.pop();
+    } else {
+      first = false;
     }
   }
   stack.pop();
   builder.push("}");
 }
 
 
 function BasicJSONSerialize(key, value, stack, builder) {
   if (IS_SPEC_OBJECT(value)) {
     var toJSON = value.toJSON;
@@ skipping 63 matching lines @@
 
 function SetUpJSON() {
   %CheckIsBootstrapping();
   InstallFunctions($JSON, DONT_ENUM, $Array(
     "parse", JSONParse,
     "stringify", JSONStringify
   ));
 }
 
 SetUpJSON();