[bootstrapper] fix transferring double properties.

R=cbruni@chromium.org

Bug: v8:6726
Change-Id: If56ce1a0b00b98ede2bb101cb9697ec516d19e81
Reviewed-on: https://chromium-review.googlesource.com/616641Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47392}

src/bootstrapper.cc

@@ -5017,8 +5017,8 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
           HandleScope inner(isolate());
           Handle<Name> key = Handle<Name>(descs->GetKey(i));
           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
-          DCHECK(!descs->GetDetails(i).representation().IsDouble());
-          Handle<Object> value(from->RawFastPropertyAt(index), isolate());
+          Handle<Object> value =
+              JSObject::FastPropertyAt(from, details.representation(), index);
           JSObject::AddProperty(to, key, value, details.attributes());
         } else {
           DCHECK_EQ(kAccessor, details.kind());

test/cctest/test-api.cc

@@ -26940,3 +26940,19 @@ TEST(DynamicImport) {
   isolate->RunMicrotasks();
   CHECK(result->Equals(i::String::cast(promise->result())));
 }
+
+TEST(GlobalTemplateWithDoubleProperty) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope handle_scope(isolate);
+
+  v8::Local<v8::ObjectTemplate> global = v8::ObjectTemplate::New(isolate);
+  global->Set(v8_str("double"), v8_num(3.14));
+
+  v8::Local<v8::Context> context = v8::Context::New(isolate, nullptr, global);
+
+  v8::Context::Scope context_scope(context);
+
+  Local<Value> result = CompileRun("double");
+  CHECK(result->IsNumber());
+  CheckDoubleEquals(3.14, result->NumberValue(context).ToChecked());
+}