[maglev] Support CloneObject

Bug: v8:7700
Change-Id: Ifc1008dce56e8f7e628a0ee0012f13403c40170b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3804668
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82177}

src/maglev/maglev-graph-builder.cc

@@ -2103,7 +2103,18 @@ void MaglevGraphBuilder::VisitCreateEmptyObjectLiteral() {
   SetAccumulator(AddNewNode<CreateEmptyObjectLiteral>({}, map));
 }
 
-MAGLEV_UNIMPLEMENTED_BYTECODE(CloneObject)
+void MaglevGraphBuilder::VisitCloneObject() {
+  // CloneObject <source_idx> <flags> <feedback_slot>
+  ValueNode* source = LoadRegisterTagged(0);
+  ValueNode* flags =
+      GetSmiConstant(interpreter::CreateObjectLiteralFlags::FlagsBits::decode(
+          GetFlagOperand(1)));
+  FeedbackSlot slot = GetSlotOperand(2);
+  compiler::FeedbackSource feedback_source{feedback(), slot};
+  SetAccumulator(BuildCallBuiltin<Builtin::kCloneObjectIC>({source, flags},
+                                                           feedback_source));
+}
+
 MAGLEV_UNIMPLEMENTED_BYTECODE(GetTemplateObject)
 
 void MaglevGraphBuilder::VisitCreateClosure() {