[es6] correctly handle object wrappers in JSON.stringify.

src/json-stringifier.h

Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index 8bcef34c79fb9b7e9ddd48e820e1b3594ae82617..e88f7d6e886096afb513aec55721e9503e765ced 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -397,9 +397,9 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
     DCHECK(value->IsBoolean());
     builder_.AppendCString(value->IsTrue() ? "true" : "false");
   } else {
-    // Fail gracefully for special value wrappers.
-    isolate_->ThrowIllegalOperation();
-    return EXCEPTION;
+    // ES6 24.3.2.1 step 10.c, serialize as an ordinary JSObject.
+    CHECK(!object->IsAccessCheckNeeded() && !object->IsJSGlobalProxy());

[Benedikt Meurer, 2015/12/02 07:43:38]

Nit: Please turn into two separate CHECKs.

[Yang, 2015/12/02 08:00:43]

Done.

+    return SerializeJSObject(object);
   }
   return SUCCESS;
 }