JSON.stringify should use toString of replacer and not valueOf

JSON.stringify should use toString of replacer and not valueOf

If the replacer array contains a number wrapper we should use the
toString result and not valueOf.

BUG=v8:4228
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Committed: https://crrev.com/6e6a1c8aee16cffdcbbf54f09b73b2b79b2ecedf
Cr-Commit-Position: refs/heads/master@{#29270}

[arv (Not doing code reviews), 2015-06-24 20:56:42]

Align better with spec algorithm

[arv (Not doing code reviews), 2015-06-24 20:57:57]

PTAL

https://codereview.chromium.org/1207013002/diff/20001/src/json.js
File src/json.js (left):

https://codereview.chromium.org/1207013002/diff/20001/src/json.js#oldcode223
src/json.js:223: // We cannot use true here because __proto__ needs to be an
object.
This comment does not apply now that __proto__ is an accessor on
Object.prototype.

[adamk, 2015-06-24 21:10:43]

lgtm

[arv (Not doing code reviews), 2015-06-24 21:11:11]

The CQ bit was checked by arv@chromium.org

[commit-bot: I haz the power, 2015-06-24 21:11:27]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1207013002/20001

[commit-bot: I haz the power, 2015-06-24 22:17:57]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-06-24 22:18:17]

Patchset 2 (id:??) landed as
https://crrev.com/6e6a1c8aee16cffdcbbf54f09b73b2b79b2ecedf
Cr-Commit-Position: refs/heads/master@{#29270}