vector-based ICs did not update type feedback counts correctly.

src/ic/ic-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_INL_H_
 #define V8_IC_INL_H_
 
 #include "src/ic/ic.h"
 
 #include "src/compiler.h"
@@ skipping 190 matching lines @@
   JSFunction* builtin_ctor = GetRootConstructor(type, native_context);
   if (builtin_ctor != NULL) {
     *flag = kCacheOnPrototype;
     return handle(builtin_ctor->initial_map());
   }
   *flag = kCacheOnReceiver;
   return TypeToMap(type, isolate);
 }
 
 
+// static
+IC::State CallIC::FeedbackToState(Isolate* isolate, TypeFeedbackVector* vector,
+                                  FeedbackVectorICSlot slot) {
+  IC::State state = UNINITIALIZED;
+  Object* feedback = vector->Get(slot);
+
+  if (feedback == *TypeFeedbackVector::MegamorphicSentinel(isolate)) {
+    state = GENERIC;
+  } else if (feedback->IsAllocationSite() || feedback->IsJSFunction()) {
+    state = MONOMORPHIC;
+  } else {
+    CHECK(feedback == *TypeFeedbackVector::UninitializedSentinel(isolate));
+  }
+
+  return state;
+}
+
+
 IC::State CallIC::FeedbackToState(Handle<TypeFeedbackVector> vector,
-                                  Handle<Smi> slot) const {
-  IC::State state = UNINITIALIZED;
-  Object* feedback = vector->get(slot->value());
+                                  FeedbackVectorICSlot slot) const {
+  return FeedbackToState(isolate(), *vector, slot);
+}
 
-  if (feedback == *TypeFeedbackVector::MegamorphicSentinel(isolate())) {
-    state = GENERIC;
-  } else if (feedback->IsAllocationSite() || feedback->IsJSFunction()) {
-    state = MONOMORPHIC;
-  } else {
-    CHECK(feedback == *TypeFeedbackVector::UninitializedSentinel(isolate()));
-  }
 
-  return state;
+void CallIC::OnTypeFeedbackChanged(Handle<TypeFeedbackVector> vector,
+                                   State old_state, State new_state) {
+  OnTypeFeedbackChanged(isolate(), address(), *vector, old_state, new_state);
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_IC_INL_H_