Adding a type vector to replace type cells.

src/full-codegen.h

Index: src/full-codegen.h
diff --git a/src/full-codegen.h b/src/full-codegen.h
index 5aa0a09fc9bd30af6ef7bf35c2eab36296c75499..328299923f7d49769ebc19615a66dcb5df228530 100644
--- a/src/full-codegen.h
+++ b/src/full-codegen.h
@@ -96,9 +96,6 @@ class FullCodeGenerator: public AstVisitor {
                          ? info->function()->ast_node_count() : 0,
                          info->zone()),
         back_edges_(2, info->zone()),
-        type_feedback_cells_(info->HasDeoptimizationSupport()
-                             ? info->function()->ast_node_count() : 0,
-                             info->zone()),
         ic_total_count_(0) {
     Initialize();
   }
@@ -434,9 +431,30 @@ class FullCodeGenerator: public AstVisitor {
   void PrepareForBailout(Expression* node, State state);
   void PrepareForBailoutForId(BailoutId id, State state);
 
-  // Cache cell support.  This associates AST ids with global property cells
-  // that will be cleared during GC and collected by the type-feedback oracle.
-  void RecordTypeFeedbackCell(TypeFeedbackId id, Handle<Cell> cell);
+  class FeedbackVectorWrapper {
+   public:
+    FeedbackVectorWrapper() : used_(0), maximum_length_(0) {}
+
+    void Initialize(Isolate* isolate, int minimum_length, int maximum_length);
+    Handle<FixedArray> FeedbackVector() { return feedback_vector_; }
+    void Visit(Isolate* isolate, AstNode* node);
+    void Set(int slot, Handle<Object> object);
+    void Finalize(Isolate* isolate);
+
+   private:
+    int used_;
+    int maximum_length_;
+    Handle<FixedArray> feedback_vector_;
+  };
+
+  // Feedback slot support. The feedback vector will be cleared during gc and
+  // collected by the type-feedback oracle.
+  Handle<FixedArray> FeedbackVector() {
+    return feedback_wrapper_.FeedbackVector();
+  }
+  void StoreFeedbackVectorSlot(int slot, Handle<Object> object) {
+    feedback_wrapper_.Set(slot, object);
+  }
 
   // Record a call's return site offset, used to rebuild the frame if the
   // called function was inlined at the site.
@@ -635,7 +653,6 @@ class FullCodeGenerator: public AstVisitor {
   void Generate();
   void PopulateDeoptimizationData(Handle<Code> code);
   void PopulateTypeFeedbackInfo(Handle<Code> code);
-  void PopulateTypeFeedbackCells(Handle<Code> code);
 
   Handle<FixedArray> handler_table() { return handler_table_; }
 
@@ -650,12 +667,6 @@ class FullCodeGenerator: public AstVisitor {
     uint32_t loop_depth;
   };
 
-  struct TypeFeedbackCellEntry {
-    TypeFeedbackId ast_id;
-    Handle<Cell> cell;
-  };
-
-
   class ExpressionContext BASE_EMBEDDED {
    public:
     explicit ExpressionContext(FullCodeGenerator* codegen)
@@ -845,9 +856,9 @@ class FullCodeGenerator: public AstVisitor {
   ZoneList<BailoutEntry> bailout_entries_;
   GrowableBitVector prepared_bailout_ids_;
   ZoneList<BackEdgeEntry> back_edges_;
-  ZoneList<TypeFeedbackCellEntry> type_feedback_cells_;
   int ic_total_count_;
   Handle<FixedArray> handler_table_;
+  FeedbackVectorWrapper feedback_wrapper_;
   Handle<Cell> profiling_counter_;
   bool generate_debug_code_;