vector-based ICs did not update type feedback counts correctly.

src/ic/ic.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_H_
 #define V8_IC_H_
 
 #include "src/ic/ic-state.h"
 #include "src/macro-assembler.h"
 
@@ skipping 66 matching lines @@
   // If the stub contains weak maps then this function adds the stub to
   // the dependent code array of each weak map.
   static void RegisterWeakMapDependency(Handle<Code> stub);
 
   // This function is called when a weak map in the stub is dying,
   // invalidates the stub by setting maps in it to undefined.
   static void InvalidateMaps(Code* stub);
 
   // Clear the inline cache to initial state.
   static void Clear(Isolate* isolate, Address address,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
 #ifdef DEBUG
   bool IsLoadStub() const {
     return target()->is_load_stub() || target()->is_keyed_load_stub();
   }
 
   bool IsStoreStub() const {
     return target()->is_store_stub() || target()->is_keyed_store_stub();
   }
@@ skipping 190 matching lines @@
   Address address_;
   IC::UtilityId id_;
 };
 
 
 class CallIC : public IC {
  public:
   explicit CallIC(Isolate* isolate) : IC(EXTRA_CALL_FRAME, isolate) {}
 
   void PatchMegamorphic(Handle<Object> function,
-                        Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                        Handle<TypeFeedbackVector> vector,
+                        FeedbackVectorICSlot slot);
 
   void HandleMiss(Handle<Object> receiver, Handle<Object> function,
-                  Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                  Handle<TypeFeedbackVector> vector, FeedbackVectorICSlot slot);
 
   // Returns true if a custom handler was installed.
   bool DoCustomHandler(Handle<Object> receiver, Handle<Object> function,
-                       Handle<TypeFeedbackVector> vector, Handle<Smi> slot,
-                       const CallICState& state);
+                       Handle<TypeFeedbackVector> vector,
+                       FeedbackVectorICSlot slot, const CallICState& state);
 
   // Code generator routines.
   static Handle<Code> initialize_stub(Isolate* isolate, int argc,
                                       CallICState::CallType call_type);
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
  private:
+  static inline IC::State FeedbackToState(Isolate* isolate,
+                                          TypeFeedbackVector* vector,
+                                          FeedbackVectorICSlot slot);
+
   inline IC::State FeedbackToState(Handle<TypeFeedbackVector> vector,
-                                   Handle<Smi> slot) const;
+                                   FeedbackVectorICSlot slot) const;
+
+  // As a vector-based IC, type feedback must be updated differently.
+  static void OnTypeFeedbackChanged(Isolate* isolate, Address address,
+                                    TypeFeedbackVector* vector, State old_state,
+                                    State new_state);
+  inline void OnTypeFeedbackChanged(Handle<TypeFeedbackVector> vector,
+                                    State old_state, State new_state);
 };
 
 
 class LoadIC : public IC {
  public:
   static ExtraICState ComputeExtraICState(ContextualMode contextual_mode) {
     return LoadICState(contextual_mode).GetExtraICState();
   }
 
   ContextualMode contextual_mode() const {
@@ skipping 55 matching lines @@
                                       CacheHolderFlag cache_holder);
 
  private:
   virtual Handle<Code> pre_monomorphic_stub() const;
   static Handle<Code> pre_monomorphic_stub(Isolate* isolate,
                                            ExtraICState extra_state);
 
   Handle<Code> SimpleFieldLoad(FieldIndex index);
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
   friend class IC;
 };
 
 
 class KeyedLoadIC : public LoadIC {
  public:
   explicit KeyedLoadIC(FrameDepth depth, Isolate* isolate)
       : LoadIC(depth, isolate) {
@@ skipping 31 matching lines @@
     return pre_monomorphic_stub(isolate());
   }
 
  private:
   Handle<Code> generic_stub() const { return generic_stub(isolate()); }
   Handle<Code> string_stub() {
     return isolate()->builtins()->KeyedLoadIC_String();
   }
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
   friend class IC;
 };
 
 
 class StoreIC : public IC {
  public:
   class StrictModeState : public BitField<StrictMode, 1, 1> {};
   static ExtraICState ComputeExtraICState(StrictMode flag) {
@@ skipping 245 matching lines @@
 
 // Support functions for interceptor handlers.
 DECLARE_RUNTIME_FUNCTION(LoadPropertyWithInterceptorOnly);
 DECLARE_RUNTIME_FUNCTION(LoadPropertyWithInterceptor);
 DECLARE_RUNTIME_FUNCTION(LoadElementWithInterceptor);
 DECLARE_RUNTIME_FUNCTION(StorePropertyWithInterceptor);
 }
 }  // namespace v8::internal
 
 #endif  // V8_IC_H_