[es6] correctly handle object wrappers in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_JSON_STRINGIFIER_H_
 #define V8_JSON_STRINGIFIER_H_
 
 #include "src/conversions.h"
 #include "src/lookup.h"
 #include "src/messages.h"
@@ skipping 379 matching lines @@
     Handle<Object> value;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, value, Object::ToNumber(object),
                                      EXCEPTION);
     if (value->IsSmi()) return SerializeSmi(Smi::cast(*value));
     SerializeHeapNumber(Handle<HeapNumber>::cast(value));
   } else if (class_name == isolate_->heap()->Boolean_string()) {
     Object* value = JSValue::cast(*object)->value();
     DCHECK(value->IsBoolean());
     builder_.AppendCString(value->IsTrue() ? "true" : "false");
   } else {
-    // Fail gracefully for special value wrappers.
-    isolate_->ThrowIllegalOperation();
-    return EXCEPTION;
+    // ES6 24.3.2.1 step 10.c, serialize as an ordinary JSObject.
+    CHECK(!object->IsAccessCheckNeeded());
+    CHECK(!object->IsJSGlobalProxy());
+    return SerializeJSObject(object);
   }
   return SUCCESS;
 }
 
 
 BasicJsonStringifier::Result BasicJsonStringifier::SerializeSmi(Smi* object) {
   static const int kBufferSize = 100;
   char chars[kBufferSize];
   Vector<char> buffer(chars, kBufferSize);
   builder_.AppendCString(IntToCString(object->value(), buffer));
@@ skipping 266 matching lines @@
     } else {
       SerializeString_<uc16, uc16>(object);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_JSON_STRINGIFIER_H_