JSON.stringify should use toString of replacer and not valueOf

src/json.js

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $jsonSerializeAdapter;
 
 (function(global, utils) {
 
 "use strict";
 
@@ skipping 190 matching lines @@
     } else {
       gap = space;
     }
   } else {
     gap = "";
   }
   if (IS_ARRAY(replacer)) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
     var seen_properties = { __proto__: null };
-    var seen_sentinel = {};
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
-      var item = replacer[i];
-      if (IS_STRING_WRAPPER(item)) {
-        item = $toString(item);
+      var v = replacer[i];
+      var item;
+      if (IS_STRING(v)) {
+        item = v;
+      } else if (IS_NUMBER(v)) {
+        item = %_NumberToString(v);
+      } else if (IS_STRING_WRAPPER(v) || IS_NUMBER_WRAPPER(v)) {
+        item = $toString(v);
       } else {
-        if (IS_NUMBER_WRAPPER(item)) item = $toNumber(item);
-        if (IS_NUMBER(item)) item = %_NumberToString(item);
+        continue;
       }
-      if (IS_STRING(item) && seen_properties[item] != seen_sentinel) {
+      if (!seen_properties[item]) {
         property_list.push(item);
-        // We cannot use true here because __proto__ needs to be an object.

[arv (Not doing code reviews), 2015/06/24 20:57:57]

This comment does not apply now that __proto__ is an accessor on
Object.prototype.

-        seen_properties[item] = seen_sentinel;
+        seen_properties[item] = true;
       }
     }
     replacer = property_list;
   }
   return JSONSerialize('', {'': value}, replacer, new InternalArray(), "", gap);
 }
 
 // -------------------------------------------------------------------
 
 %AddNamedProperty(GlobalJSON, symbolToStringTag, "JSON", READ_ONLY | DONT_ENUM);
 
 // Set up non-enumerable properties of the JSON object.
 utils.InstallFunctions(GlobalJSON, DONT_ENUM, [
   "parse", JSONParse,
   "stringify", JSONStringify
 ]);
 
 // -------------------------------------------------------------------
 // JSON Builtins
 
 $jsonSerializeAdapter = function(key, object) {
   var holder = {};
   holder[key] = object;
   // No need to pass the actual holder since there is no replacer function.
   return JSONSerialize(key, holder, UNDEFINED, new InternalArray(), "", "");
 }
 
 })