vector-based ICs did not update type feedback counts correctly.

src/objects-debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/disasm.h"
 #include "src/disassembler.h"
 #include "src/heap/objects-visiting.h"
 #include "src/jsregexp.h"
@@ skipping 337 matching lines @@
 }
 
 
 void PolymorphicCodeCache::PolymorphicCodeCacheVerify() {
   VerifyHeapPointer(cache());
   CHECK(cache()->IsUndefined() || cache()->IsPolymorphicCodeCacheHashTable());
 }
 
 
 void TypeFeedbackInfo::TypeFeedbackInfoVerify() {
+  feedback_vector()->IsTypeFeedbackVector();

[Jakob Kummerow, 2014/10/14 15:27:20]

CHECK(...)?

[mvstanton, 2014/10/16 10:54:14]

:D. Done.

   VerifyObjectField(kStorage1Offset);
   VerifyObjectField(kStorage2Offset);
   VerifyObjectField(kStorage3Offset);
 }
 
 
 void AliasedArgumentsEntry::AliasedArgumentsEntryVerify() {
   VerifySmiField(kAliasedContextSlot);
 }
 
@@ skipping 836 matching lines @@
   for (int i = 0; i < number_of_transitions(); ++i) {
     if (!CheckOneBackPointer(current_map, GetTarget(i))) return false;
   }
   return true;
 }
 
 
 #endif  // DEBUG
 
 } }  // namespace v8::internal