vector-based ICs did not update type feedback counts correctly.

src/type-info.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_INFO_H_
 #define V8_TYPE_INFO_H_
 
 #include "src/allocation.h"
 #include "src/globals.h"
 #include "src/types.h"
 #include "src/zone-inl.h"
 
 namespace v8 {
 namespace internal {
 
 // Forward declarations.
 class SmallMapList;
 
 
 class TypeFeedbackOracle: public ZoneObject {
  public:
   TypeFeedbackOracle(Handle<Code> code,
                      Handle<TypeFeedbackVector> feedback_vector,
                      Handle<Context> native_context, Zone* zone);
 
   bool LoadIsUninitialized(TypeFeedbackId id);
   bool StoreIsUninitialized(TypeFeedbackId id);
-  bool CallIsMonomorphic(FeedbackVectorSlot slot);
+  bool CallIsMonomorphic(FeedbackVectorICSlot slot);
   bool CallIsMonomorphic(TypeFeedbackId aid);

[Jakob Kummerow, 2014/10/14 15:27:20]

While you're here: this method doesn't seem to exist any more.

[mvstanton, 2014/10/16 10:54:15]

Done.

   bool KeyedArrayCallIsHoley(TypeFeedbackId id);
   bool CallNewIsMonomorphic(FeedbackVectorSlot slot);
 
   // TODO(1571) We can't use ForInStatement::ForInType as the return value due
   // to various cycles in our headers.
   // TODO(rossberg): once all oracle access is removed from ast.cc, it should
   // be possible.
   byte ForInType(FeedbackVectorSlot feedback_vector_slot);
 
   KeyedAccessStoreMode GetStoreMode(TypeFeedbackId id);
@@ skipping 12 matching lines @@
   void CountReceiverTypes(TypeFeedbackId id,
                           SmallMapList* receiver_types);
 
   void CollectReceiverTypes(TypeFeedbackId id,
                             SmallMapList* types);
 
   static bool CanRetainOtherContext(Map* map, Context* native_context);
   static bool CanRetainOtherContext(JSFunction* function,
                                     Context* native_context);
 
-  Handle<JSFunction> GetCallTarget(FeedbackVectorSlot slot);
-  Handle<AllocationSite> GetCallAllocationSite(FeedbackVectorSlot slot);
+  Handle<JSFunction> GetCallTarget(FeedbackVectorICSlot slot);
+  Handle<AllocationSite> GetCallAllocationSite(FeedbackVectorICSlot slot);
   Handle<JSFunction> GetCallNewTarget(FeedbackVectorSlot slot);
   Handle<AllocationSite> GetCallNewAllocationSite(FeedbackVectorSlot slot);
 
   bool LoadIsBuiltin(TypeFeedbackId id, Builtins::Name builtin_id);
 
   // TODO(1571) We can't use ToBooleanStub::Types as the return value because
   // of various cycles in our headers. Death to tons of implementations in
   // headers!! :-P
   byte ToBooleanTypes(TypeFeedbackId id);
 
@@ skipping 32 matching lines @@
                           Code* new_code);
   void ProcessRelocInfos(ZoneList<RelocInfo>* infos);
 
   // Returns an element from the backing store. Returns undefined if
   // there is no information.
   Handle<Object> GetInfo(TypeFeedbackId id);
 
   // Returns an element from the type feedback vector. Returns undefined
   // if there is no information.
   Handle<Object> GetInfo(FeedbackVectorSlot slot);
+  Handle<Object> GetInfo(FeedbackVectorICSlot slot);
 
  private:
   Handle<Context> native_context_;
   Zone* zone_;
   Handle<UnseededNumberDictionary> dictionary_;
   Handle<TypeFeedbackVector> feedback_vector_;
 
   DISALLOW_COPY_AND_ASSIGN(TypeFeedbackOracle);
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_TYPE_INFO_H_