Fix length check in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 672 matching lines @@
 void BasicJsonStringifier::SerializeStringUnchecked_(const SrcChar* src,
                                                      DestChar* dest,
                                                      int length) {
   dest += current_index_;
   DestChar* dest_start = dest;
 
   // Assert that uc16 character is not truncated down to 8 bit.
   // The <uc16, char> version of this method must not be called.
   ASSERT(sizeof(*dest) >= sizeof(*src));
 
-  *(dest++) = '"';
   for (int i = 0; i < length; i++) {
     SrcChar c = src[i];
     if (DoNotEscape(c)) {
       *(dest++) = static_cast<DestChar>(c);
     } else {
       const char* chars = &JsonEscapeTable[c * kJsonEscapeTableEntrySize];
       while (*chars != '\0') *(dest++) = *(chars++);
     }
   }
 
-  *(dest++) = '"';
   current_index_ += static_cast<int>(dest - dest_start);
 }
 
 
 template <bool is_ascii, typename Char>
 void BasicJsonStringifier::SerializeString_(Vector<const Char> vector,
                                             Handle<String> string) {
   int length = vector.length();
+  Append_<is_ascii, char>('"');
   // We make a rough estimate to find out if the current string can be
   // serialized without allocating a new string part. The worst case length of
-  // an escaped character is 6.  Shifting left by 3 is a more pessimistic
-  // estimate than multiplying by 6, but faster to calculate.
-  static const int kEnclosingQuotesLength = 2;
-  if (current_index_ + (length << 3) + kEnclosingQuotesLength < part_length_) {
+  // an escaped character is 6.  Shifting the remainin string length right by 3
+  // is a more pessimistic estimate, but faster to calculate.
+
+  if (((part_length_ - current_index_) >> 3) > length) {
     if (is_ascii) {
       SerializeStringUnchecked_(
           vector.start(),
           SeqAsciiString::cast(*current_part_)->GetChars(),
           length);
     } else {
       SerializeStringUnchecked_(
           vector.start(),
           SeqTwoByteString::cast(*current_part_)->GetChars(),
           length);
     }
   } else {
-    Append_<is_ascii, char>('"');
     String* string_location = *string;
     for (int i = 0; i < length; i++) {
       Char c = vector[i];
       if (DoNotEscape(c)) {
         Append_<is_ascii, Char>(c);
       } else {
         Append_<is_ascii, char>(
             &JsonEscapeTable[c * kJsonEscapeTableEntrySize]);
       }
       // If GC moved the string, we need to refresh the vector.
       if (*string != string_location) {
         vector = GetCharVector<Char>(string);
         string_location = *string;
       }
     }
-    Append_<is_ascii, char>('"');
   }
+
+  Append_<is_ascii, char>('"');
 }
 
 
 template <>
 bool BasicJsonStringifier::DoNotEscape(char c) {
   return c >= '#' && c <= '~' && c != '\\';
 }
 
 
 template <>
@@ skipping 33 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_