vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_FEEDBACK_VECTOR_INL_H_
 #define V8_TYPE_FEEDBACK_VECTOR_INL_H_
 
 #include "src/type-feedback-vector.h"
 
 namespace v8 {
 namespace internal {
 
+int TypeFeedbackVector::ic_with_type_info_count() {
+  return length() > 0 ? Smi::cast(get(kWithTypesIndex))->value() : 0;
+}
+
+
+void TypeFeedbackVector::change_ic_with_type_info_count(int delta) {
+  if (delta == 0) return;
+  int value = ic_with_type_info_count() + delta;
+  // Could go negative because of the debugger.
+  if (value >= 0) {
+    set(kWithTypesIndex, Smi::FromInt(value));
+  }
+}
+
+
+int TypeFeedbackVector::ic_generic_count() {
+  return length() > 0 ? Smi::cast(get(kGenericCountIndex))->value() : 0;
+}
+
+
+void TypeFeedbackVector::change_ic_generic_count(int delta) {
+  if (delta == 0) return;
+  int value = ic_generic_count() + delta;
+  if (value >= 0) {
+    set(kGenericCountIndex, Smi::FromInt(value));
+  }
+}
+
+
+int TypeFeedbackVector::Slots() {
+  if (length() == 0) return 0;
+  int first_ic_slot = first_ic_slot_index();

[ulan, 2014/10/15 10:17:06]

If instead of -1, you would make first_ic_slot == length() when there are no
ic_slots, then functions here would be simpler:

Slots(): return Max(0, first_ic_slot_index() - kReservedIndexCount);
ICSlots(): return length() - first_ic_slot_index();

[mvstanton, 2014/10/16 10:54:14]

Done.

+  if (first_ic_slot >= 0) {
+    DCHECK(first_ic_slot >= kReservedIndexCount);
+    return first_ic_slot - kReservedIndexCount;
+  }
+  DCHECK(length() >= kReservedIndexCount);
+  return length() - kReservedIndexCount;
+}
+
+
+int TypeFeedbackVector::ICSlots() {
+  if (length() == 0) return 0;
+  int first_ic_slot = first_ic_slot_index();
+  if (first_ic_slot < 0) return 0;
+  DCHECK(first_ic_slot >= kReservedIndexCount);
+  return length() - first_ic_slot;
+}
+
+
+int TypeFeedbackVector::GetIndex(FeedbackVectorSlot slot) {
+  return kReservedIndexCount + slot.ToInt();
+}
+
+
+int TypeFeedbackVector::GetIndex(FeedbackVectorICSlot slot) {
+  int first_ic_slot = first_ic_slot_index();
+  DCHECK(first_ic_slot >= 0);

[ulan, 2014/10/15 10:17:05]

DCHECK(slot.ToInt() < ICSlots()) would be more precise.

[mvstanton, 2014/10/16 10:54:15]

Done.

+  return first_ic_slot + slot.ToInt();
+}
+
+
+FeedbackVectorSlot TypeFeedbackVector::ToSlot(int index) {
+  DCHECK(index >= kReservedIndexCount);

[ulan, 2014/10/15 10:17:06]

also DCHECK(index < first_ic_slot_index() || first_ic_slot_index() == -1)?

[mvstanton, 2014/10/16 10:54:15]

Done.

+  return FeedbackVectorSlot(index - kReservedIndexCount);
+}
+
+
+FeedbackVectorICSlot TypeFeedbackVector::ToICSlot(int index) {
+  DCHECK(index >= kReservedIndexCount);

[ulan, 2014/10/15 10:17:05]

DCHECK(index >= first_ic_slot_index) would be more precise.
also DCHECK(index < length())

[mvstanton, 2014/10/16 10:54:15]

Done.

+  DCHECK(first_ic_slot_index() >= 0);
+  return FeedbackVectorICSlot(index - first_ic_slot_index());
+}
+
+
+Object* TypeFeedbackVector::Get(FeedbackVectorSlot slot) {
+  return get(kReservedIndexCount + slot.ToInt());

[ulan, 2014/10/15 10:17:06]

Why not use GetIndex(slot) here and below? :)

[mvstanton, 2014/10/16 10:54:14]

Oh brother, great idea, thx!

+}
+
+
+void TypeFeedbackVector::Set(FeedbackVectorSlot slot, Object* value,
+                             WriteBarrierMode mode) {
+  set(kReservedIndexCount + slot.ToInt(), value, mode);
+}
+
+
+Object* TypeFeedbackVector::Get(FeedbackVectorICSlot slot) {
+  int first_ic_slot = first_ic_slot_index();
+  DCHECK(first_ic_slot >= 0 && first_ic_slot < length());
+  return get(first_ic_slot + slot.ToInt());
+}
+
+
+void TypeFeedbackVector::Set(FeedbackVectorICSlot slot, Object* value,
+                             WriteBarrierMode mode) {
+  int first_ic_slot = first_ic_slot_index();
+  DCHECK(first_ic_slot >= 0 && first_ic_slot < length());
+  set(first_ic_slot + slot.ToInt(), value, mode);
+}
+
+
 Handle<Object> TypeFeedbackVector::UninitializedSentinel(Isolate* isolate) {
   return isolate->factory()->uninitialized_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::MegamorphicSentinel(Isolate* isolate) {
   return isolate->factory()->megamorphic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::PremonomorphicSentinel(Isolate* isolate) {
-  return isolate->factory()->megamorphic_symbol();
+  return isolate->factory()->premonomorphic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::GenericSentinel(Isolate* isolate) {
   return isolate->factory()->generic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::MonomorphicArraySentinel(
     Isolate* isolate, ElementsKind elements_kind) {
   return Handle<Object>(Smi::FromInt(static_cast<int>(elements_kind)), isolate);
 }
 
 
 Object* TypeFeedbackVector::RawUninitializedSentinel(Heap* heap) {
   return heap->uninitialized_symbol();
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_TYPE_FEEDBACK_VECTOR_INL_H_