Fix stack overflow in JSON.stringify.

test/mjsunit/json-recursive.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 20 matching lines @@
   var current = {};
   current.a = a;
   a = current;
 }
 
 function rec(a,b,c,d,e,f,g,h,i,j,k,l,m,n) {
   JSON.stringify(a);
   rec(a,b,c,d,e,f,g,h,i,j,k,l,m,n);
 }
 
-assertThrows(
-    function() { rec(1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4) },
-    RangeError);
+assertThrows(function() { rec(1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4) },
+             RangeError);
 
+
+var deepArray = [];
+for (var i = 0; i < 2048; i++) deepArray = [deepArray];
+JSON.stringify(deepArray);
+for (var i = 2048; i < 4097; i++) deepArray = [deepArray];
+assertThrows(function() { JSON.stringify(deepArray); }, RangeError);
+
+
+var deepObject = {};
+for (var i = 0; i < 2048; i++) deepObject = { next: deepObject };
+JSON.stringify(deepObject);
+for (var i = 2048; i < 4097; i++) deepObject = { next: deepObject };
+assertThrows(function() { JSON.stringify(deepObject); }, RangeError);