Fix issues with JSON stringify replacer array

src/json.js

Index: src/json.js
diff --git a/src/json.js b/src/json.js
index 0799deadfe957f9bf598cbfc3006d25eb60e6a2b..fc4b58decaf67b7335812377b2f1c6a8f25eb2a7 100644
--- a/src/json.js
+++ b/src/json.js
@@ -213,14 +213,21 @@ function JSONStringify(value, replacer, space) {
   if (IS_ARRAY(replacer)) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
-    var seen_properties = {};
+    var seen_properties = { __proto__: null };
+    var seen_sentinel = {};
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
       var item = replacer[i];
-      if (IS_NUMBER(item)) item = %_NumberToString(item);
-      if (IS_STRING(item) && !(item in seen_properties)) {
+      if (IS_STRING_WRAPPER(item)) {
+        item = ToString(item);
+      } else {
+        if (IS_NUMBER_WRAPPER(item)) item = ToNumber(item);
+        if (IS_NUMBER(item)) item = %_NumberToString(item);
+      }
+      if (IS_STRING(item) && seen_properties[item] != seen_sentinel) {
         property_list.push(item);
-        seen_properties[item] = true;
+        // We cannot use true here because __proto__ needs to be an object.
+        seen_properties[item] = seen_sentinel;
       }
     }
     replacer = property_list;