[MERGE #6002 @MikeHolman] don't look up numeric properties from cache in json code

Merge pull request #6002 from MikeHolman:stringifycache

inline caches don't support numeric properties, so skip inline cache check lookup for numeric properties in json stringifier

Fixes #5951

Author: MikeHolman

lib/Runtime/Library/JSONStringifier.cpp

@@ -221,22 +221,31 @@ _Ret_notnull_ Var
 JSONStringifier::ReadValue(_In_ JavascriptString* key, _In_opt_ const PropertyRecord* propertyRecord, _In_ RecyclableObject* holder)
 {
     Var value = nullptr;
-    PropertyString* propertyString = JavascriptOperators::TryFromVar<PropertyString>(key);
     PropertyValueInfo info;
-    if (propertyString != nullptr)
-    {
-        PropertyValueInfo::SetCacheInfo(&info, propertyString, propertyString->GetLdElemInlineCache(), false);
-        if (propertyString->TryGetPropertyFromCache<false /* ownPropertyOnly */, false /* OutputExistence */>(holder, holder, &value, this->scriptContext, &info))
-        {
-            return value;
-        }
-    }
 
     if (propertyRecord == nullptr)
     {
         key->GetPropertyRecord(&propertyRecord);
     }
-    JavascriptOperators::GetProperty(holder, propertyRecord->GetPropertyId(), &value, this->scriptContext, &info);
+
+    if (propertyRecord->IsNumeric())
+    {
+        JavascriptOperators::GetItem(holder, propertyRecord->GetNumericValue(), &value, this->scriptContext);
+    }
+    else
+    {
+        PropertyString* propertyString = JavascriptOperators::TryFromVar<PropertyString>(key);
+        if (propertyString != nullptr)
+        {
+            PropertyValueInfo::SetCacheInfo(&info, propertyString, propertyString->GetLdElemInlineCache(), false);
+            if (propertyString->TryGetPropertyFromCache<false /* ownPropertyOnly */, false /* OutputExistence */>(holder, holder, &value, this->scriptContext, &info))
+            {
+                return value;
+            }
+        }
+        JavascriptOperators::GetProperty(holder, propertyRecord->GetPropertyId(), &value, this->scriptContext, &info);
+    }
+
     return value;
 }
 

test/JSON/cacheassert.js

@@ -0,0 +1,9 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+JSON.stringify({}, [0]);                                                           
+JSON.stringify({0: {}}, [0]);
+
+print("Pass")

test/JSON/rlexe.xml

@@ -14,6 +14,11 @@
       <tags>exclude_jenkins</tags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>cacheassert.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>stringify-replacer.js</files>