Add JSON.stringify stack overflow tests

test/built-ins/JSON/stringify/replacer-function-object-deleted-property.js

@@ -5,10 +5,17 @@ esid: sec-serializejsonproperty
 description: >
   Replacer function is called on properties, deleted during stringification.
 info: |
-  JSON.stringify ( value [ , replacer [ , space ] ] )
+  SerializeJSONObject ( value )
 
   [...]
-  12. Return ? SerializeJSONProperty(the empty String, wrapper).
+  5. If PropertyList is not undefined, then
+    [...]
+  6. Else,
+    a. Let K be ? EnumerableOwnPropertyNames(value, key).
+  [...]
+  8. For each element P of K, do
+    a. Let strP be ? SerializeJSONProperty(P, value).
+    [...]
 
   SerializeJSONProperty ( key, holder )
 

test/built-ins/JSON/stringify/replacer-function-stack-overflow.js

@@ -0,0 +1,35 @@
+// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-json.stringify
+description: >
+  Stack overflow due to infinite recursion in replacer throws an expected error.
+---*/
+
+var getStackOverflowError = function() {
+  try {
+    return getStackOverflowError();
+  } catch (err) {
+    return err;
+  }
+};
+
+var StackOverflowError = getStackOverflowError().constructor;
+
+var obj = {};
+var objReplacer = function() {
+  return {key: obj};
+};
+
+assert.throws(StackOverflowError, function() {
+  JSON.stringify(null, objReplacer);
+});
+
+var arr = [];
+var arrReplacer = function() {
+  return [arr];
+};
+
+assert.throws(StackOverflowError, function() {
+  JSON.stringify(null, arrReplacer);
+});

test/built-ins/JSON/stringify/value-tojson-stack-overflow.js

@@ -0,0 +1,35 @@
+// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-json.stringify
+description: >
+  Stack overflow due to infinite recursion in toJSON throws an expected error.
+---*/
+
+var getStackOverflowError = function() {
+  try {
+    return getStackOverflowError();
+  } catch (err) {
+    return err;
+  }
+};
+
+var StackOverflowError = getStackOverflowError().constructor;
+
+var obj = {};
+obj.toJSON = function() {
+  return {key: obj};
+};
+
+assert.throws(StackOverflowError, function() {
+  JSON.stringify(obj);
+});
+
+var arr = [];
+arr.toJSON = function() {
+  return [arr];
+};
+
+assert.throws(StackOverflowError, function() {
+  JSON.stringify(arr);
+});