JSON serializer should fail gracefully for special value wrappers.

src/json-stringifier.h

Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index 444de43e7bc79b04cc2aa0238f1159d62b774413..efb71e5fb11d59f74fdfa3f2f31e94974670497b 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -396,11 +396,14 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
         isolate_, value, Execution::ToNumber(isolate_, object), EXCEPTION);
     if (value->IsSmi()) return SerializeSmi(Smi::cast(*value));
     SerializeHeapNumber(Handle<HeapNumber>::cast(value));
-  } else {
-    DCHECK(class_name == isolate_->heap()->Boolean_string());
+  } else if (class_name == isolate_->heap()->Boolean_string()) {
     Object* value = JSValue::cast(*object)->value();
     DCHECK(value->IsBoolean());
     builder_.AppendCString(value->IsTrue() ? "true" : "false");
+  } else {
+    // Fail gracefully for special value wrappers.
+    isolate_->ThrowIllegalOperation();
+    return EXCEPTION;
   }
   return SUCCESS;
 }