[json] Allow any callable object for toJSON.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_JSON_STRINGIFIER_H_
 #define V8_JSON_STRINGIFIER_H_
 
 #include "src/conversions.h"
 #include "src/lookup.h"
 #include "src/messages.h"
@@ skipping 227 matching lines @@
   }
 }
 
 
 MaybeHandle<Object> BasicJsonStringifier::ApplyToJsonFunction(
     Handle<Object> object, Handle<Object> key) {
   LookupIterator it(object, tojson_string_,
                     LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
   Handle<Object> fun;
   ASSIGN_RETURN_ON_EXCEPTION(isolate_, fun, Object::GetProperty(&it), Object);
-  if (!fun->IsJSFunction()) return object;
+  if (!fun->IsCallable()) return object;
 
   // Call toJSON function.
   if (key->IsSmi()) key = factory()->NumberToString(key);
   Handle<Object> argv[] = { key };
   HandleScope scope(isolate_);
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate_, object,
       Execution::Call(isolate_, fun, object, 1, argv),
       Object);
   return scope.CloseAndEscape(object);
@@ skipping 418 matching lines @@
     } else {
       SerializeString_<uc16, uc16>(object);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_JSON_STRINGIFIER_H_