Fix CloneObject to work without feedback vector

Bug: v8:8394
Change-Id: I3db77f090249251b9765ce869fd8268d43d8347c
Reviewed-on: https://chromium-review.googlesource.com/c/1375663Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58271}

src/ic/ic.cc

@@ -2699,7 +2699,14 @@ RUNTIME_FUNCTION(Runtime_CloneObjectIC_Miss) {
   MigrateDeprecated(source);
 
   FeedbackSlot slot = FeedbackVector::ToSlot(args.smi_at(2));
-  Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);
+  Handle<HeapObject> maybe_vector = args.at<HeapObject>(3);
+  if (maybe_vector->IsUndefined()) {
+    RETURN_RESULT_OR_FAILURE(isolate,
+                             CloneObjectSlowPath(isolate, source, flags));
+  }
+
+  DCHECK(maybe_vector->IsFeedbackVector());
+  Handle<FeedbackVector> vector = Handle<FeedbackVector>::cast(maybe_vector);
 
   FeedbackNexus nexus(vector, slot);
   Handle<Map> source_map(source->map(), isolate);

src/interpreter/interpreter-generator.cc

@@ -2639,9 +2639,21 @@ IGNITION_HANDLER(CloneObject, InterpreterAssembler) {
   Node* smi_slot = SmiTag(raw_slot);
   Node* maybe_feedback_vector = LoadFeedbackVectorUnchecked();
   Node* context = GetContext();
-  Node* result = CallBuiltin(Builtins::kCloneObjectIC, context, source,
-                             smi_flags, smi_slot, maybe_feedback_vector);
-  SetAccumulator(result);
+
+  Variable var_result(this, MachineRepresentation::kTagged);
+  Label no_feedback(this), end(this);
+  GotoIf(IsUndefined(maybe_feedback_vector), &no_feedback);
+  var_result.Bind(CallBuiltin(Builtins::kCloneObjectIC, context, source,
+                              smi_flags, smi_slot, maybe_feedback_vector));
+  Goto(&end);
+
+  BIND(&no_feedback);
+  var_result.Bind(CallRuntime(Runtime::kCloneObjectIC_Miss, context, source,
+                              smi_flags, smi_slot, maybe_feedback_vector));
+  Goto(&end);
+
+  BIND(&end);
+  SetAccumulator(var_result.value());
   Dispatch();
 }