vector-based ICs did not update type feedback counts correctly.

test/unittests/compiler/js-typed-lowering-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 61 matching lines @@
 // -----------------------------------------------------------------------------
 // JSLoadProperty
 
 
 TEST_F(JSTypedLoweringTest, JSLoadPropertyFromExternalTypedArray) {
   const size_t kLength = 17;
   uint8_t backing_store[kLength * 8];
   Handle<JSArrayBuffer> buffer =
       NewArrayBuffer(backing_store, arraysize(backing_store));
   VectorSlotPair feedback(Handle<TypeFeedbackVector>::null(),
-                          FeedbackVectorSlot::Invalid());
+                          FeedbackVectorICSlot::Invalid());
   TRACED_FOREACH(ExternalArrayType, type, kExternalArrayTypes) {
     Handle<JSTypedArray> array =
         factory()->NewJSTypedArray(type, buffer, kLength);
 
     Node* key = Parameter(Type::Integral32());
     Node* base = HeapConstant(array);
     Node* context = UndefinedConstant();
     Node* effect = graph()->start();
     Node* control = graph()->start();
     Node* node = graph()->NewNode(javascript()->LoadProperty(feedback), base,
@@ skipping 64 matching lines @@
                   CaptureEq(&elements)),
               key, IsInt32Constant(static_cast<int>(kLength)), value, effect,
               control));
     }
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8