Fix bug in JSON.stringify where Boolean objects are incorrectly...

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 189 matching lines @@
   if (IS_FUNCTION(replacer)) {
     value = replacer.call(holder, key, value);
   }
   // Unwrap value if necessary
   if (IS_OBJECT(value)) {
     if (IS_NUMBER_WRAPPER(value)) {
       value = $Number(value);
     } else if (IS_STRING_WRAPPER(value)) {
       value = $String(value);
     } else if (IS_BOOLEAN_WRAPPER(value)) {
-      value = $Boolean(value);
+      value =  %_ValueOf(value);
     }
   }
   switch (typeof value) {
     case "string":
       return QuoteJSONString(value);
     case "object":
       if (!value) {
         return "null";
       } else if (IS_ARRAY(value)) {
         return SerializeArray(value, replacer, stack, indent, gap);
@@ skipping 38 matching lines @@
 }
 
 function SetupJSON() {
   InstallFunctions($JSON, DONT_ENUM, $Array(
     "parse", JSONParse,
     "stringify", JSONStringify
   ));
 }
 
 SetupJSON();