Fix stack overflow in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 27 matching lines @@
 class BasicJsonStringifier BASE_EMBEDDED {
  public:
   explicit BasicJsonStringifier(Isolate* isolate);
 
   MaybeObject* Stringify(Handle<Object> object);
 
  private:
   static const int kInitialPartLength = 32;
   static const int kMaxPartLength = 16 * 1024;
   static const int kPartLengthGrowthFactor = 2;
-  static const int kStackLimit = 8 * 1024;
+  static const int kStackLimit = 4 * 1024;
 
   enum Result { UNCHANGED, SUCCESS, BAILOUT, CIRCULAR, STACK_OVERFLOW };
 
   template <bool is_ascii> void Extend();
 
   void ChangeEncoding();
 
   void ShrinkCurrentPart();
 
   template <bool is_ascii, typename Char>
@@ skipping 333 matching lines @@
   char chars[kBufferSize];
   Vector<char> buffer(chars, kBufferSize);
   Append(DoubleToCString(number, buffer));
   return SUCCESS;
 }
 
 
 BasicJsonStringifier::Result BasicJsonStringifier::SerializeArray(
     Handle<JSArray> object) {
   HandleScope handle_scope(isolate_);
-  if (StackPush(object) == CIRCULAR) return CIRCULAR;
+  Result stack_push = StackPush(object);
+  if (stack_push != SUCCESS) return stack_push;
   int length = Smi::cast(object->length())->value();
   Append('[');
   switch (object->GetElementsKind()) {
     case FAST_SMI_ELEMENTS: {
       Handle<FixedArray> elements = Handle<FixedArray>(
           FixedArray::cast(object->elements()));
       for (int i = 0; i < length; i++) {
         if (i > 0) Append(',');
         SerializeSmi(Smi::cast(elements->get(i)));
       }
@@ skipping 264 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_