JSON.stringify should use toString of replacer and not valueOf

If the replacer array contains a number wrapper we should use the
toString result and not valueOf.

BUG=v8:4228
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1207013002

Cr-Commit-Position: refs/heads/master@{#29270}

src/json.js

@@ -208,20 +208,22 @@ function JSONStringify(value, replacer, space) {
     // Deduplicate replacer array items.
     var property_list = new InternalArray();
     var seen_properties = { __proto__: null };
-    var seen_sentinel = {};
     var length = replacer.length;
     for (var i = 0; i < length; i++) {
-      var item = replacer[i];
-      if (IS_STRING_WRAPPER(item)) {
-        item = $toString(item);
+      var v = replacer[i];
+      var item;
+      if (IS_STRING(v)) {
+        item = v;
+      } else if (IS_NUMBER(v)) {
+        item = %_NumberToString(v);
+      } else if (IS_STRING_WRAPPER(v) || IS_NUMBER_WRAPPER(v)) {
+        item = $toString(v);
       } else {
-        if (IS_NUMBER_WRAPPER(item)) item = $toNumber(item);
-        if (IS_NUMBER(item)) item = %_NumberToString(item);
+        continue;
       }
-      if (IS_STRING(item) && seen_properties[item] != seen_sentinel) {
+      if (!seen_properties[item]) {
         property_list.push(item);
-        // We cannot use true here because __proto__ needs to be an object.
-        seen_properties[item] = seen_sentinel;
+        seen_properties[item] = true;
       }
     }
     replacer = property_list;

test/mjsunit/json-replacer-number-wrapper-tostring.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// http://ecma-international.org/ecma-262/6.0/#sec-json.stringify
+// Step 4.b.iii.5.f.i
+
+var calls = 0;
+
+var num = new Number;
+num.toString = function() {
+  calls++;
+  return '';
+};
+num.valueOf = function() {
+  assertUnreachable();
+};
+
+JSON.stringify('', [num]);
+assertEquals(1, calls);