Fixed mutable heap numbers leak in JSON parser.

test/mjsunit/regress/regress-crbug-423687.js

Index: test/mjsunit/regress/regress-crbug-423687.js
diff --git a/test/mjsunit/regress/regress-crbug-412210.js b/test/mjsunit/regress/regress-crbug-423687.js
similarity index 67%
copy from test/mjsunit/regress/regress-crbug-412210.js
copy to test/mjsunit/regress/regress-crbug-423687.js
index 6ec7d62379c2dbc511da1c29d96216637e1fcae1..60003527e81453b895ee8ad5b9c3517a5648ff8f 100644
--- a/test/mjsunit/regress/regress-crbug-412210.js
+++ b/test/mjsunit/regress/regress-crbug-423687.js
@@ -4,9 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-function f(x) {
-  return (x ? "" >> 0 : "") + /a/;
-};
+var json = '{"a":{"c":2.1,"d":0},"b":{"c":7,"1024":8}}';
+var data = JSON.parse(json);
 
-%OptimizeFunctionOnNextCall(f);
-f();
+data.b.c++;