vector-based ICs did not update type feedback counts correctly.

src/ic/ic-state.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/ic/ic.h"
 #include "src/ic/ic-state.h"
 
 namespace v8 {
 namespace internal {
 
 void ICUtility::Clear(Isolate* isolate, Address address,
+                      TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                       ConstantPoolArray* constant_pool) {
-  IC::Clear(isolate, address, constant_pool);
+  IC::Clear(isolate, address, vector, slot, constant_pool);
 }
 
 
 CallICState::CallICState(ExtraICState extra_ic_state)
     : argc_(ArgcBits::decode(extra_ic_state)),
       call_type_(CallTypeBits::decode(extra_ic_state)) {}
 
 
 ExtraICState CallICState::GetExtraICState() const {
   ExtraICState extra_ic_state =
@@ skipping 579 matching lines @@
     case UNIQUE_NAME:
     case OBJECT:
     case GENERIC:
       return GENERIC;
   }
   UNREACHABLE();
   return GENERIC;  // Make the compiler happy.
 }
 }
 }  // namespace v8::internal