CallIC must update type feedback info correctly.

src/ic-inl.h

Index: src/ic-inl.h
diff --git a/src/ic-inl.h b/src/ic-inl.h
index 4a3edbe3f9bdcc59f2d7510ce3a967ba92092323..ad0078e886565cb89f9e91eb58b340d8d965b4a3 100644
--- a/src/ic-inl.h
+++ b/src/ic-inl.h
@@ -168,6 +168,20 @@ Handle<Map> IC::GetICCacheHolder(HeapType* type, Isolate* isolate,
   return TypeToMap(type, isolate);
 }
 
+
+IC::State CallIC::FeedbackObjectToState(Object* feedback) const {
+  IC::State state = UNINITIALIZED;
+
+  if (feedback == *TypeFeedbackInfo::MegamorphicSentinel(isolate())) {
+    state = GENERIC;
+  } else if (feedback->IsAllocationSite() || feedback->IsJSFunction()) {
+    state = MONOMORPHIC;
+  } else {
+    CHECK(feedback == *TypeFeedbackInfo::UninitializedSentinel(isolate()));
+  }
+
+  return state;
+}
 } }  // namespace v8::internal
 
 #endif  // V8_IC_INL_H_