CallIC must update type feedback info correctly.

src/ic.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_H_
 #define V8_IC_H_
 
 #include "src/macro-assembler.h"
 
 namespace v8 {
@@ skipping 157 matching lines @@
                                 Handle<Object> object,
                                 Handle<Object> key);
   MaybeHandle<Object> ReferenceError(const char* type, Handle<String> name);
 
   // Access the target code for the given IC address.
   static inline Code* GetTargetAtAddress(Address address,
                                          ConstantPoolArray* constant_pool);
   static inline void SetTargetAtAddress(Address address,
                                         Code* target,
                                         ConstantPoolArray* constant_pool);
+  static void OnTypeFeedbackChanged(Isolate* isolate, Address address,
+                                    State old_state, State new_state,
+                                    bool target_remains_ic_stub);
   static void PostPatching(Address address, Code* target, Code* old_target);
 
   // Compute the handler either by compiling or by retrieving a cached version.
   Handle<Code> ComputeHandler(LookupIterator* lookup, Handle<Object> object,
                               Handle<String> name,
                               Handle<Object> value = Handle<Code>::null());
   virtual Handle<Code> CompileHandler(LookupIterator* lookup,
                                       Handle<Object> object,
                                       Handle<String> name, Handle<Object> value,
                                       CacheHolderFlag cache_holder) {
@@ skipping 182 matching lines @@
                        Handle<Smi> slot,
                        const State& state);
 
   // Code generator routines.
   static Handle<Code> initialize_stub(Isolate* isolate,
                                       int argc,
                                       CallType call_type);
 
   static void Clear(Isolate* isolate, Address address, Code* target,
                     ConstantPoolArray* constant_pool);
+
+ private:
+  void UpdateTypeFeedbackInfo(Object* old_feedback, Object* new_feedback);
+  inline IC::State FeedbackObjectToState(Object* feedback) const;
 };
 
 
 OStream& operator<<(OStream& os, const CallIC::State& s);
 
 
 class LoadIC: public IC {
  public:
   enum ParameterIndices {
     kReceiverIndex,
@@ skipping 642 matching lines @@
 DECLARE_RUNTIME_FUNCTION(ElementsTransitionAndStoreIC_Miss);
 DECLARE_RUNTIME_FUNCTION(BinaryOpIC_Miss);
 DECLARE_RUNTIME_FUNCTION(BinaryOpIC_MissWithAllocationSite);
 DECLARE_RUNTIME_FUNCTION(CompareNilIC_Miss);
 DECLARE_RUNTIME_FUNCTION(ToBooleanIC_Miss);
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_IC_H_