Fix #2109: stringify should handle objects with non-coercible length

Root cause is that some JS objects cannot be coerced to a Number:

Number({toString: 0});
TypeError: can't convert ({toString:0}) to number
Number({a: 0});
NaN

lib/utils.js

@@ -454,7 +454,7 @@ function jsonStringify(object, spaces, depth) {
   var space = spaces * depth;
   var str = isArray(object) ? '[' : '{';
   var end = isArray(object) ? ']' : '}';
-  var length = object.length || exports.keys(object).length;
+  var length = typeof object.length === 'number' ? object.length : exports.keys(object).length;
   // `.repeat()` polyfill
   function repeat(s, n) {
     return new Array(n).join(s);

test/acceptance/utils.js

@@ -331,6 +331,10 @@ describe('lib/utils', function () {
 
       stringify(a).should.equal('{\n  "foo": 1\n}');
     });
+
+    it('should handle length properties that cannot be coerced to a number', function () {
+      stringify({length: {toString: 0}}).should.equal('{\n  "length": {\n    "toString": 0\n  }\n}');
+    });
   });
 
   describe('type', function () {