Type Feedback Vector lives in the closure

src/runtime/runtime-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/compiler.h"
 #include "src/deoptimizer.h"
 #include "src/frames-inl.h"
@@ skipping 22 matching lines @@
 
   // Compile the target function.
   DCHECK(function->shared()->allows_lazy_compilation());
 
   Handle<Code> code;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, code,
                                      Compiler::GetLazyCode(function));
   DCHECK(code->IsJavaScriptCode());
 
   function->ReplaceCode(*code);
+  JSFunction::EnsureLiterals(function);
   return *code;
 }
 
 
 namespace {
 
 Object* CompileOptimized(Isolate* isolate, Handle<JSFunction> function,
                          Compiler::ConcurrencyMode mode) {
   StackLimitCheck check(isolate);
   if (check.JsHasOverflowed(1 * KB)) return isolate->StackOverflow();
@@ skipping 371 matching lines @@
   DCHECK(is_valid_language_mode(args.smi_at(3)));
   LanguageMode language_mode = static_cast<LanguageMode>(args.smi_at(3));
   DCHECK(args[4]->IsSmi());
   Handle<SharedFunctionInfo> outer_info(args.at<JSFunction>(2)->shared(),
                                         isolate);
   return CompileGlobalEval(isolate, args.at<String>(1), outer_info,
                            language_mode, args.smi_at(4));
 }
 }  // namespace internal
 }  // namespace v8