[runtime] Maintain bit pattern of heap numbers copied in Object::WrapForRead

R=ishell@chromium.org, jarin@chromium.org, verwaest@chromium.org

Bug: v8:9404
Change-Id: I7ec189340a77052cbdcb8e5802f7ac8197fafe10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1680541Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62462}

src/objects/objects.cc

@@ -212,8 +212,8 @@ Handle<Object> Object::WrapForRead(Isolate* isolate, Handle<Object> object,
     DCHECK(object->FitsRepresentation(representation));
     return object;
   }
-  return isolate->factory()->NewHeapNumber(
-      MutableHeapNumber::cast(*object).value());
+  return isolate->factory()->NewHeapNumberFromBits(
+      MutableHeapNumber::cast(*object).value_as_bits());
 }
 
 MaybeHandle<JSReceiver> Object::ToObjectImpl(Isolate* isolate,

test/mjsunit/mjsunit.status

@@ -639,12 +639,6 @@
   'wasm/float-constant-folding': [SKIP],
 }],
 
-##############################################################################
-['arch == ia32 and mode == debug', {
-  # BUG(v8:9404).
-  'regress/regress-crbug-976598': [SKIP],
-}],
-
 ##############################################################################
 ['arch == mipsel or arch == mips', {