vector-based ICs did not update type feedback counts correctly.

src/full-codegen.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_FULL_CODEGEN_H_
 #define V8_FULL_CODEGEN_H_
 
 #include "src/v8.h"
 
 #include "src/allocation.h"
@@ skipping 411 matching lines @@
   void EmitLiteralCompareNil(CompareOperation* expr,
                              Expression* sub_expr,
                              NilValue nil);
 
   // Bailout support.
   void PrepareForBailout(Expression* node, State state);
   void PrepareForBailoutForId(BailoutId id, State state);
 
   // Feedback slot support. The feedback vector will be cleared during gc and
   // collected by the type-feedback oracle.
-  Handle<FixedArray> FeedbackVector() {
+  Handle<TypeFeedbackVector> FeedbackVector() const {
     return info_->feedback_vector();
   }
   void EnsureSlotContainsAllocationSite(FeedbackVectorSlot slot);
+  void EnsureSlotContainsAllocationSite(FeedbackVectorICSlot slot);
+
+  // Returns a smi for the index into the FixedArray that backs the feedback
+  // vector
   Smi* SmiFromSlot(FeedbackVectorSlot slot) const {
-    return Smi::FromInt(slot.ToInt());
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
+  }
+
+  Smi* SmiFromSlot(FeedbackVectorICSlot slot) const {
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
   }
 
   // Record a call's return site offset, used to rebuild the frame if the
   // called function was inlined at the site.
   void RecordJSReturnSite(Call* call);
 
   // Prepare for bailout before a test (or compare) and branch.  If
   // should_normalize, then the following comparison will not handle the
   // canonical JS true value so we will insert a (dead) test against true at
   // the actual bailout target from the optimized code. If not
@@ skipping 212 matching lines @@
 #undef DECLARE_VISIT
 
   void VisitComma(BinaryOperation* expr);
   void VisitLogicalExpression(BinaryOperation* expr);
   void VisitArithmeticExpression(BinaryOperation* expr);
 
   void VisitForTypeofValue(Expression* expr);
 
   void Generate();
   void PopulateDeoptimizationData(Handle<Code> code);
-  void PopulateTypeFeedbackInfo(Handle<Code> code);
+  void PopulateTypeFeedbackInfo(Handle<Code> code,
+                                Handle<TypeFeedbackVector> vector);
 
   Handle<FixedArray> handler_table() { return handler_table_; }
 
   struct BailoutEntry {
     BailoutId id;
     unsigned pc_and_state;
   };
 
   struct BackEdgeEntry {
     BailoutId id;
@@ skipping 302 matching lines @@
 
   Address start_;
   Address instruction_start_;
   uint32_t length_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_FULL_CODEGEN_H_