Type Feedback Vector lives in the closure

src/runtime/runtime-scopes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/accessors.h"
 #include "src/arguments.h"
 #include "src/ast/scopeinfo.h"
 #include "src/ast/scopes.h"
@@ skipping 704 matching lines @@
   // caller has been inlined, better make sure we are not hitting that case.
   JavaScriptFrameIterator it(isolate);
   DCHECK(!it.frame()->HasInlinedFrames());
 #endif  // DEBUG
   Handle<JSFunction> callee;
   ParameterArguments argument_getter(parameters);
   return *NewRestArguments(isolate, callee, argument_getter, num_params,
                            rest_index);
 }
 
+RUNTIME_FUNCTION(Runtime_InstallLiterals) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+  JSFunction::EnsureLiterals(function);
+  return *function;
+}
 
 RUNTIME_FUNCTION(Runtime_NewClosure) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(SharedFunctionInfo, shared, 0);
   Handle<Context> context(isolate->context(), isolate);
   return *isolate->factory()->NewFunctionFromSharedFunctionInfo(shared, context,
                                                                 NOT_TENURED);
 }
 
@@ skipping 513 matching lines @@
 
   // Lookup in the initial Object.prototype object.
   Handle<Object> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
       Object::GetProperty(isolate->initial_object_prototype(), key));
   return *result;
 }
 }  // namespace internal
 }  // namespace v8