[TypeFeedbackVector/Crankshaft] Fix private symbol feedback.

src/type-feedback-vector.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/type-feedback-vector.h"
 
 #include "src/code-stubs.h"
 #include "src/ic/ic.h"
 #include "src/ic/ic-state.h"
 #include "src/objects.h"
 #include "src/type-feedback-vector-inl.h"
 
 namespace v8 {
 namespace internal {
 
 
 static bool IsPropertyNameFeedback(Object* feedback) {
-  return feedback->IsString() ||
-         (feedback->IsSymbol() && !Symbol::cast(feedback)->is_private());
+  if (feedback->IsString()) return true;
+  if (!feedback->IsSymbol()) return false;
+  Symbol* symbol = Symbol::cast(feedback);
+  Heap* heap = symbol->GetHeap();
+  return symbol != heap->uninitialized_symbol() &&
+         symbol != heap->premonomorphic_symbol() &&
+         symbol != heap->megamorphic_symbol();
 }
 
 
 std::ostream& operator<<(std::ostream& os, FeedbackVectorSlotKind kind) {
   return os << TypeFeedbackMetadata::Kind2String(kind);
 }
 
 
 FeedbackVectorSlotKind TypeFeedbackMetadata::GetKind(
     FeedbackVectorSlot slot) const {
@@ skipping 789 matching lines @@
   return mode;
 }
 
 
 IcCheckType KeyedStoreICNexus::GetKeyType() const {
   // The structure of the vector slots tells us the type.
   return GetFeedback()->IsName() ? PROPERTY : ELEMENT;
 }
 }  // namespace internal
 }  // namespace v8