JSON.stringify should use toString of replacer and not valueOf

src/json.js

Index: src/json.js
diff --git a/src/json.js b/src/json.js
index 8b5f2294491433b26cd3b026b768772f0ada0697..fe820f9b06f928ffe657c478f71360fb297f775d 100644
--- a/src/json.js
+++ b/src/json.js
@@ -208,20 +208,22 @@ function JSONStringify(value, replacer, space) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
     var seen_properties = { __proto__: null };
-    var seen_sentinel = {};
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
-      var item = replacer[i];
-      if (IS_STRING_WRAPPER(item)) {
-        item = $toString(item);
+      var v = replacer[i];
+      var item;
+      if (IS_STRING(v)) {
+        item = v;
+      } else if (IS_NUMBER(v)) {
+        item = %_NumberToString(v);
+      } else if (IS_STRING_WRAPPER(v) || IS_NUMBER_WRAPPER(v)) {
+        item = $toString(v);
       } else {
-        if (IS_NUMBER_WRAPPER(item)) item = $toNumber(item);
-        if (IS_NUMBER(item)) item = %_NumberToString(item);
+        continue;
       }
-      if (IS_STRING(item) && seen_properties[item] != seen_sentinel) {
+      if (!seen_properties[item]) {
         property_list.push(item);
-        // We cannot use true here because __proto__ needs to be an object.

[arv (Not doing code reviews), 2015/06/24 20:57:57]

This comment does not apply now that __proto__ is an accessor on
Object.prototype.

-        seen_properties[item] = seen_sentinel;
+        seen_properties[item] = true;
       }
     }
     replacer = property_list;