--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -522,29 +522,25 @@ InitializeGap(JSContext *cx, jsval space
 
     return JS_TRUE;
 }
 
 JSBool
 js_Stringify(JSContext *cx, jsval *vp, JSObject *replacer, jsval space,
              JSCharBuffer &cb)
 {
-    // XXX stack
-    JSObject *stack = JS_NewArrayObject(cx, 0, NULL);
-    if (!stack)
-        return JS_FALSE;
-
     StringifyContext scx(cx, cb, replacer);
     if (!InitializeGap(cx, space, scx.gap))
         return JS_FALSE;
 
     JSObject *obj = js_NewObject(cx, &js_ObjectClass, NULL, NULL);
     if (!obj)
         return JS_FALSE;
 
+    JSAutoTempValueRooter tvr(cx, obj);
     if (!obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.emptyAtom),
                              *vp, NULL, NULL, JSPROP_ENUMERATE)) {
         return JS_FALSE;
     }
 
     return Str(cx, ATOM_TO_JSID(cx->runtime->atomState.emptyAtom), obj, &scx, vp);
 }