Type Feedback Vector lives in the closure

src/snapshot/serialize.cc

Index: src/snapshot/serialize.cc
diff --git a/src/snapshot/serialize.cc b/src/snapshot/serialize.cc
index 421cf0721cda7f2702da16e698986a94d9bde480..143e54634f88e98d4432e2a79ffb946171b45a9a 100644
--- a/src/snapshot/serialize.cc
+++ b/src/snapshot/serialize.cc
@@ -1797,8 +1797,15 @@ void PartialSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
 
   // Clear literal boilerplates.
   if (obj->IsJSFunction()) {
-    FixedArray* literals = JSFunction::cast(obj)->literals();
-    for (int i = 0; i < literals->length(); i++) literals->set_undefined(i);
+    LiteralsArray* literals = JSFunction::cast(obj)->literals();
+    for (int i = 0; i < literals->literals_count(); i++) {
+      literals->set_undefined(i);
+    }
+    // TODO(mvstanton): remove this line when the vector moves to the closure.
+    // We need to clear the vector so the serializer doesn't try to serialize
+    // the vector in the startup snapshot and the partial snapshot(s).
+    literals->set_feedback_vector(
+        TypeFeedbackVector::cast(isolate_->heap()->empty_fixed_array()));
   }
 
   // Object has not yet been serialized.  Serialize it here.