Don't use `instanceof` in lib/util.js "is" checks.

While using `instanceof`, these functions could easily be faked with something
like:  Object.create(Date.prototype)

So let's just not use it at all. A little slower, but these functions are only
used in the REPL / for debugging so it's OK.

Fixes #1941.
Fixes #1942.

lib/util.js

@@ -378,31 +378,29 @@ function reduceToSingleString(output, base, braces) {
 }
 
 
+// NOTE: These type checking functions intentionally don't use `instanceof`
+// because it is fragile and can be easily faked with `Object.create()`.
 function isArray(ar) {
-  return ar instanceof Array ||
+  return Array.isArray(ar) ||
-         Array.isArray(ar) ||
+         (typeof ar === 'object' && objectToString(ar) === '[object Array]');
-         (ar && ar !== Object.prototype && isArray(ar.__proto__));
 }
 exports.isArray = isArray;
 
 
 function isRegExp(re) {
-  return re instanceof RegExp ||
+  return typeof re === 'object' && objectToString(re) === '[object RegExp]';
-      (typeof re === 'object' && objectToString(re) === '[object RegExp]');
 }
 exports.isRegExp = isRegExp;
 
 
 function isDate(d) {
-  return d instanceof Date ||
+  return typeof d === 'object' && objectToString(d) === '[object Date]';
-      (typeof d === 'object' && objectToString(d) === '[object Date]');
 }
 exports.isDate = isDate;
 
 
 function isError(e) {
-  return e instanceof Error ||
+  return typeof e === 'object' && objectToString(e) === '[object Error]';
-      (typeof e === 'object' && objectToString(e) === '[object Error]');
 }
 exports.isError = isError;