JSON.stringify should handle the replacer before the space

BUG=v8:4227
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200373003

Cr-Commit-Position: refs/heads/master@{#29273}

src/json.js

@@ -183,27 +183,6 @@ function JSONStringify(value, replacer, space) {
   if (%_ArgumentsLength() == 1) {
     return %BasicJSONStringify(value);
   }
-  if (IS_OBJECT(space)) {
-    // Unwrap 'space' if it is wrapped
-    if (IS_NUMBER_WRAPPER(space)) {
-      space = $toNumber(space);
-    } else if (IS_STRING_WRAPPER(space)) {
-      space = $toString(space);
-    }
-  }
-  var gap;
-  if (IS_NUMBER(space)) {
-    space = MathMax(0, MathMin($toInteger(space), 10));
-    gap = %_SubString("          ", 0, space);
-  } else if (IS_STRING(space)) {
-    if (space.length > 10) {
-      gap = %_SubString(space, 0, 10);
-    } else {
-      gap = space;
-    }
-  } else {
-    gap = "";
-  }
   if (IS_ARRAY(replacer)) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
@@ -228,6 +207,27 @@ function JSONStringify(value, replacer, space) {
     }
     replacer = property_list;
   }
+  if (IS_OBJECT(space)) {
+    // Unwrap 'space' if it is wrapped
+    if (IS_NUMBER_WRAPPER(space)) {
+      space = $toNumber(space);
+    } else if (IS_STRING_WRAPPER(space)) {
+      space = $toString(space);
+    }
+  }
+  var gap;
+  if (IS_NUMBER(space)) {
+    space = MathMax(0, MathMin($toInteger(space), 10));
+    gap = %_SubString("          ", 0, space);
+  } else if (IS_STRING(space)) {
+    if (space.length > 10) {
+      gap = %_SubString(space, 0, 10);
+    } else {
+      gap = space;
+    }
+  } else {
+    gap = "";
+  }
   return JSONSerialize('', {'': value}, replacer, new InternalArray(), "", gap);
 }
 

test/mjsunit/json-replacer-order.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// http://ecma-international.org/ecma-262/6.0/#sec-json.stringify
+// Step 4.b.iii.5.f.i
+
+var log = [];
+
+var replacer = Object.defineProperty([], 0, {
+  get() {
+    log.push('get 0');
+  }
+});
+var space = Object.defineProperty(new String, 'toString', {
+  value() {
+    log.push('toString');
+    return '';
+  }
+});
+
+JSON.stringify('', replacer, space);
+
+assertEquals(2, log.length);
+assertEquals('get 0', log[0]);
+assertEquals('toString', log[1]);