Implement function proxies (except for their use as constructors).

src/json.js

Index: src/json.js
diff --git a/src/json.js b/src/json.js
index 6c984a157df36803f31ff87021e2c36e96207aa0..2a8a2321e95d5aa509059877f9d19a31faca5220 100644
--- a/src/json.js
+++ b/src/json.js
@@ -54,7 +54,7 @@ function Revive(holder, name, reviver) {
 
 function JSONParse(text, reviver) {
   var unfiltered = %ParseJson(TO_STRING_INLINE(text));
-  if (IS_FUNCTION(reviver)) {
+  if (IS_SPEC_FUNCTION(reviver)) {
     return Revive({'': unfiltered}, '', reviver);
   } else {
     return unfiltered;
@@ -143,11 +143,11 @@ function JSONSerialize(key, holder, replacer, stack, indent, gap) {
   var value = holder[key];
   if (IS_SPEC_OBJECT(value)) {
     var toJSON = value.toJSON;
-    if (IS_FUNCTION(toJSON)) {
+    if (IS_SPEC_FUNCTION(toJSON)) {
       value = %_CallFunction(value, key, toJSON);
     }
   }
-  if (IS_FUNCTION(replacer)) {
+  if (IS_SPEC_FUNCTION(replacer)) {
     value = %_CallFunction(holder, key, value, replacer);
   }
   if (IS_STRING(value)) {
@@ -273,7 +273,7 @@ function BasicSerializeObject(value, stack, builder) {
 function BasicJSONSerialize(key, value, stack, builder) {
   if (IS_SPEC_OBJECT(value)) {
     var toJSON = value.toJSON;
-    if (IS_FUNCTION(toJSON)) {
+    if (IS_SPEC_FUNCTION(toJSON)) {
       value = %_CallFunction(value, ToString(key), toJSON);
     }
   }