[CloneObjectIC] copy may_have_interesting_symbols bit to fast result map

This fixes a CHECK failure in MapVerify, and gets the correct behaviour
for uses of the well-known symbols.

BUG=v8:7611, chromium:866229
R=jkummerow@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org

Change-Id: I5d679357b8807ea9d1054121d8d336fe0dd43c7c
Reviewed-on: https://chromium-review.googlesource.com/1162278Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#54905}

src/ic/ic.cc

@@ -2519,6 +2519,10 @@ static Handle<Map> FastCloneObjectMap(Isolate* isolate,
   map->InitializeDescriptors(*descriptors, *layout);
   map->CopyUnusedPropertyFieldsAdjustedForInstanceSize(*source_map);
 
+  // Update bitfields
+  map->set_may_have_interesting_symbols(
+      source_map->may_have_interesting_symbols());
+
   return map;
 }
 

test/mjsunit/es9/regress/regress-866229.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = { length: 1, 0: "spread" };
+obj[Symbol.toStringTag] = "foo";
+obj[Symbol.hasInstance] = function() { return true; }
+obj[Symbol.isConcatSpreadable] = true;
+
+var obj2 = { ...obj };
+
+// Crash if fast result map bitfield is not set correctly, if verifying heap
+%HeapObjectVerify(obj2);
+
+// Ensure correct result for some well-known symbols
+assertEquals("[object foo]", Object.prototype.toString.call(obj2));
+assertTrue(Uint8Array instanceof obj2);
+assertEquals(["spread"], [].concat(obj2));