Reland JSON.stringify reimplementation.

test/mjsunit/regress/regress-json-stringify-gc.js

Index: test/mjsunit/regress/regress-json-stringify-gc.js
diff --git a/test/mjsunit/regress/regress-2185.js b/test/mjsunit/regress/regress-json-stringify-gc.js
similarity index 77%
copy from test/mjsunit/regress/regress-2185.js
copy to test/mjsunit/regress/regress-json-stringify-gc.js
index 895f322fc63880b2a5c3f0480673d6f01cace9cd..42087167e77025c48fa83ceb107c50cd1288d8af 100644
--- a/test/mjsunit/regress/regress-2185.js
+++ b/test/mjsunit/regress/regress-json-stringify-gc.js
@@ -26,11 +26,16 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 var a = [];
-
-for (var i = 0; i < 2; i++) {
-  for (var j = 0; j < 30000; j++) {
-    a.push(j);
-  }
+var new_space_string = "";
+for (var i = 0; i < 128; i++) {
+  new_space_string += String.fromCharCode((Math.random() * 26 + 65) | 0);
 }
+for (var i = 0; i < 10000; i++) a.push(new_space_string);
+
+// At some point during the first stringify, allocation causes a GC and
+// new_space_string is moved to old space. Make sure that this does not
+// screw up reading from the correct location.
+json1 = JSON.stringify(a);
+json2 = JSON.stringify(a);
+assertEquals(json1, json2);
 
-a.sort(function(a, b) { return a - b; } );