[es6] correctly handle object wrappers in JSON.stringify.

src/json-stringifier.h

Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index 8bcef34c79fb9b7e9ddd48e820e1b3594ae82617..c96f975c9e2ca03baf18d1ade4738a042f85b91c 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -397,9 +397,10 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
     DCHECK(value->IsBoolean());
     builder_.AppendCString(value->IsTrue() ? "true" : "false");
   } else {
-    // Fail gracefully for special value wrappers.
-    isolate_->ThrowIllegalOperation();
-    return EXCEPTION;
+    // ES6 24.3.2.1 step 10.c, serialize as an ordinary JSObject.
+    CHECK(!object->IsAccessCheckNeeded());
+    CHECK(!object->IsJSGlobalProxy());
+    return SerializeJSObject(object);
   }
   return SUCCESS;
 }