vector-based ICs did not update type feedback counts correctly.

src/arm64/full-codegen-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
@@ skipping 1163 matching lines @@
 
   __ Bind(&no_descriptors);
   __ Drop(1);
   __ B(&exit);
 
   // We got a fixed array in register x0. Iterate through that.
   __ Bind(&fixed_array);
 
   __ LoadObject(x1, FeedbackVector());
   __ Mov(x10, Operand(TypeFeedbackVector::MegamorphicSentinel(isolate())));
-  __ Str(x10, FieldMemOperand(x1, FixedArray::OffsetOfElementAt(slot.ToInt())));
+  int vector_index = FeedbackVector()->GetIndex(slot);
+  __ Str(x10, FieldMemOperand(x1, FixedArray::OffsetOfElementAt(vector_index)));
 
   __ Mov(x1, Smi::FromInt(1));  // Smi indicates slow check.
   __ Peek(x10, 0);  // Get enumerated object.
   STATIC_ASSERT(FIRST_JS_PROXY_TYPE == FIRST_SPEC_OBJECT_TYPE);
   // TODO(all): similar check was done already. Can we avoid it here?
   __ CompareObjectType(x10, x11, x12, LAST_JS_PROXY_TYPE);
   DCHECK(Smi::FromInt(0) == 0);
   __ CzeroX(x1, le);  // Zero indicates proxy.
   __ Ldr(x2, FieldMemOperand(x0, FixedArray::kLengthOffset));
   // Smi and array, fixed array length (as smi) and initial index.
@@ skipping 1357 matching lines @@
       VisitForStackValue(args->at(i));
     }
   }
   // Record source position of the IC call.
   SetSourcePosition(expr->position());
 
   Handle<Code> ic = CallIC::initialize_stub(
       isolate(), arg_count, call_type);
   __ Mov(x3, SmiFromSlot(expr->CallFeedbackSlot()));
   __ Peek(x1, (arg_count + 1) * kXRegSize);
-  // Don't assign a type feedback id to the IC, since type feedback is provided
-  // by the vector above.
-  CallIC(ic);
+  CallIC(ic, TypeFeedbackId(expr->CallFeedbackSlot().ToInt()));
 
   RecordJSReturnSite(expr);
   // Restore context register.
   __ Ldr(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   context()->DropAndPlug(1, x0);
 }
 
 
 void FullCodeGenerator::EmitResolvePossiblyDirectEval(int arg_count) {
   ASM_LOCATION("FullCodeGenerator::EmitResolvePossiblyDirectEval");
@@ skipping 2606 matching lines @@
   return previous_;
 }
 
 
 #undef __
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM64