vector-based ICs did not update type feedback counts correctly.

src/heap/objects-visiting-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_VISITING_INL_H_
 #define V8_OBJECTS_VISITING_INL_H_
 
 
 namespace v8 {
 namespace internal {
@@ skipping 243 matching lines @@
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::VisitCodeTarget(Heap* heap,
                                                           RelocInfo* rinfo) {
   DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
   Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   // Monomorphic ICs are preserved when possible, but need to be flushed
   // when they might be keeping a Context alive, or when the heap is about
   // to be serialized.
   if (FLAG_cleanup_code_caches_at_gc && target->is_inline_cache_stub() &&
       (target->ic_state() == MEGAMORPHIC || target->ic_state() == GENERIC ||
-       target->ic_state() == POLYMORPHIC ||
+       target->ic_state() == POLYMORPHIC || target->is_call_stub() ||
        (heap->flush_monomorphic_ics() && !target->is_weak_stub()) ||
        heap->isolate()->serializer_enabled() ||
        target->ic_age() != heap->global_ic_age() ||
        target->is_invalidated_weak_stub())) {
-    ICUtility::Clear(heap->isolate(), rinfo->pc(),
+    TypeFeedbackVector* vector = NULL;
+    FeedbackVectorICSlot slot(FeedbackVectorICSlot::Invalid());
+    if (target->is_call_stub()) {
+      Object* feedback_info = rinfo->host()->type_feedback_info();
+      vector = feedback_info->IsTypeFeedbackInfo()
+                   ? TypeFeedbackInfo::cast(feedback_info)->feedback_vector()
+                   : NULL;
+      slot = FeedbackVectorICSlot(static_cast<unsigned>(rinfo->data()));
+    }
+    ICUtility::Clear(heap->isolate(), rinfo->pc(), vector, slot,
                      rinfo->host()->constant_pool());
     target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   }
   heap->mark_compact_collector()->RecordRelocSlot(rinfo, target);
   StaticVisitor::MarkObject(heap, target);
 }
 
 
 template <typename StaticVisitor>
 void StaticMarkingVisitor<StaticVisitor>::VisitCodeAgeSequence(
@@ skipping 645 matching lines @@
 
   RelocIterator it(this, mode_mask);
   for (; !it.done(); it.next()) {
     it.rinfo()->template Visit<StaticVisitor>(heap);
   }
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_VISITING_INL_H_