vector-based ICs did not update type feedback counts correctly.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_H_
 #define V8_OBJECTS_H_
 
 #include <iosfwd>
 
 #include "src/allocation.h"
@@ skipping 8072 matching lines @@
   inline void change_ic_generic_count(int delta);
 
   inline void initialize_storage();
 
   inline void change_own_type_change_checksum();
   inline int own_type_change_checksum();
 
   inline void set_inlined_type_change_checksum(int checksum);
   inline bool matches_inlined_type_change_checksum(int checksum);
 
-
+  DECL_ACCESSORS(feedback_vector, TypeFeedbackVector)
   DECLARE_CAST(TypeFeedbackInfo)
 
   // Dispatched behavior.
   DECLARE_PRINTER(TypeFeedbackInfo)
   DECLARE_VERIFIER(TypeFeedbackInfo)
 
-  static const int kStorage1Offset = HeapObject::kHeaderSize;
+  static const int kFeedbackVectorOffset = HeapObject::kHeaderSize;
+  static const int kStorage1Offset = kFeedbackVectorOffset + kPointerSize;
   static const int kStorage2Offset = kStorage1Offset + kPointerSize;
   static const int kStorage3Offset = kStorage2Offset + kPointerSize;
   static const int kSize = kStorage3Offset + kPointerSize;
 
  private:
   static const int kTypeChangeChecksumBits = 7;
 
   class ICTotalCountField: public BitField<int, 0,
       kSmiValueSize - kTypeChangeChecksumBits> {};  // NOLINT
   class OwnTypeChangeChecksum: public BitField<int,
@@ skipping 2740 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_