[json] fix encoding change for two-byte gap strings.

R=mstarzinger@chromium.org
BUG=chromium:613570

Review-Url: https://codereview.chromium.org/1997003002
Cr-Commit-Position: refs/heads/master@{#36433}

src/json-stringifier.h

@@ -198,7 +198,8 @@ BasicJsonStringifier::BasicJsonStringifier(Isolate* isolate, Handle<String> gap)
   stack_ = factory()->NewJSArray(8);
   int gap_length = gap->length();
   if (gap_length != 0) {
-    String::Flatten(gap);
+    gap = String::Flatten(gap);
+    if (gap->IsTwoByteRepresentation()) builder_.ChangeEncoding();
     DisallowHeapAllocation no_gc;
     String::FlatContent flat = gap->GetFlatContent();
     gap_ = NewArray<uc16>(gap_length + 1);
@@ -206,7 +207,6 @@ BasicJsonStringifier::BasicJsonStringifier(Isolate* isolate, Handle<String> gap)
       CopyChars(gap_, flat.ToOneByteVector().start(), gap_length);
     } else {
       CopyChars(gap_, flat.ToUC16Vector().start(), gap_length);
-      builder_.ChangeEncoding();
     }
     gap_[gap_length] = '\0';
   } else {

test/mjsunit/regress/regress-crbug-613570.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("[\n\u26031,\n\u26032\n]",
+             JSON.stringify([1, 2], null, "\u2603"));