[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n

Review URL: https://codereview.chromium.org/1748633002

Cr-Commit-Position: refs/heads/master@{#34387}

src/js/json.js

@@ -51,7 +51,9 @@ function InternalizeJSONProperty(holder, name, reviver) {
         }
       }
     } else {
-      for (var p of %object_keys(val)) {
+      var keys = %object_keys(val);
+      for (var i = 0; i < keys.length; i++) {
+        var p = keys[i];
         var newElement = InternalizeJSONProperty(val, p, reviver);
         if (IS_UNDEFINED(newElement)) {
           %reflect_delete_property(val, p);
@@ -122,7 +124,9 @@ function SerializeObject(value, replacer, stack, indent, gap) {
       }
     }
   } else {
-    for (var p of %object_keys(value)) {
+    var keys = %object_keys(value);
+    for (var i = 0; i < keys.length; i++) {
+      var p = keys[i];
       var strP = JSONSerialize(p, value, replacer, stack, indent, gap);
       if (!IS_UNDEFINED(strP)) {
         var member = %QuoteJSONString(p) + ":";

test/mjsunit/regress/regress-4769.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://bugs.chromium.org/p/v8/issues/detail?id=4769
+
+Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
+
+JSON.stringify({foo: [42]});
+JSON.stringify({foo: [42]}, []);
+JSON.stringify({foo: [42]}, undefined, ' ');
+JSON.stringify({foo: [42]}, [], ' ');