Revert "[CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated"

This reverts commit 670fa86f.

Reason for revert: Causes gc-stress bots to fail - 
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8939819990688690880/+/steps/Check_-_d8/0/logs/object-spread-ic/0
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8939819696982258192/+/steps/Check_-_d8/0/logs/object-spread-ic/0

Original change's description:
> [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated
> 
> An object with a deprecated Map which has already been cached in
> CloneObjectIC feedback is still a valid Map for fast cloning --- but
> to be consistent with other ICs, deprecated maps are ignored, and are
> expected to be transitioned away from.
> 
> If the source object has a deprecated map, the instance is migrated.
> 
> BUG=v8:7611, chromium:867958
> R=​jkummerow@chromium.org, mvstanton@chromium.org
> 
> Change-Id: I9771b00400fb4dda45a62e874a31d9b50630d847
> Reviewed-on: https://chromium-review.googlesource.com/1152414
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Cr-Commit-Position: refs/heads/master@{#54758}

TBR=jkummerow@chromium.org,mvstanton@chromium.org,caitp@igalia.com

Change-Id: Id17652ad6f3f09adb43848069549ad146d48b2d7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7611, chromium:867958
Reviewed-on: https://chromium-review.googlesource.com/1153747Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54760}

src/feedback-vector.cc

@@ -756,14 +756,13 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
       SetFeedbackExtra(*result_map);
       break;
     case MONOMORPHIC:
-      if (maybe_feedback->IsClearedWeakHeapObject() ||
-          Map::cast(*feedback)->is_deprecated()) {
+      if (maybe_feedback->IsClearedWeakHeapObject()) {
         // Remain in MONOMORPHIC state if previous feedback has been collected.
         SetFeedback(HeapObjectReference::Weak(*source_map));
         SetFeedbackExtra(*result_map);
       } else {
         // Transition to POLYMORPHIC.
-        DCHECK(!source_map.is_identical_to(feedback));
+        DCHECK_NE(*source_map, *feedback);
         Handle<WeakFixedArray> array =
             EnsureArrayOfSize(2 * kCloneObjectPolymorphicEntrySize);
         array->Set(0, maybe_feedback);
@@ -779,12 +778,10 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
       Handle<WeakFixedArray> array = Handle<WeakFixedArray>::cast(feedback);
       int i = 0;
       for (; i < array->length(); i += kCloneObjectPolymorphicEntrySize) {
-        MaybeObjectHandle feedback(array->Get(i), isolate);
-        if (feedback->IsClearedWeakHeapObject() ||
-            Map::cast(*feedback.object())->is_deprecated()) {
+        if (array->Get(i)->IsClearedWeakHeapObject()) {
           break;
         }
-        DCHECK(!feedback.object().is_identical_to(source_map));
+        DCHECK_NE(array->Get(i)->GetHeapObject(), *source_map);
       }
 
       if (i >= array->length()) {

src/ic/ic.cc

@@ -2549,9 +2549,6 @@ RUNTIME_FUNCTION(Runtime_CloneObjectIC_Miss) {
   DCHECK_EQ(4, args.length());
   Handle<HeapObject> source = args.at<HeapObject>(0);
   int flags = args.smi_at(1);
-
-  MigrateDeprecated(source);
-
   FeedbackSlot slot = FeedbackVector::ToSlot(args.smi_at(2));
   Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);
 

test/mjsunit/es9/regress/regress-867958.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Check that encountering deprecated Maps does not cause CloneObjectIC to
-// crash.
-var obj1 = { x: 1 };
-var obj2 = { x: 2 }; // same map
-obj2.x = null; // deprecate map
-
-function f() { return { ...obj1 } };
-assertEquals({ x: 1 }, f()); // missed, object migrated to cached new map
-assertEquals({ x: 1 }, f()); // monomorphic cache-hit