How does V8 instance_type work in case of subclassing? Specifically for a built-in like Array

Question

Am trying to wrap my head around how JSON.stringify in V8 still results in the square bracket notation ([....]) for subclassed Arrays

In the V8 code I see th