vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_FEEDBACK_VECTOR_INL_H_
 #define V8_TYPE_FEEDBACK_VECTOR_INL_H_
 
 #include "src/type-feedback-vector.h"
 
 namespace v8 {
 namespace internal {
 
+int TypeFeedbackVector::ic_with_type_info_count() {
+  return length() > 0 ? Smi::cast(get(kWithTypesIndex))->value() : 0;
+}
+
+
+void TypeFeedbackVector::change_ic_with_type_info_count(int delta) {
+  if (delta == 0) return;
+  int value = ic_with_type_info_count() + delta;
+  // Could go negative because of the debugger.
+  if (value >= 0) {
+    set(kWithTypesIndex, Smi::FromInt(value));
+  }
+}
+
+
+int TypeFeedbackVector::ic_generic_count() {
+  return length() > 0 ? Smi::cast(get(kGenericCountIndex))->value() : 0;
+}
+
+
+void TypeFeedbackVector::change_ic_generic_count(int delta) {
+  if (delta == 0) return;
+  int value = ic_generic_count() + delta;
+  if (value >= 0) {
+    set(kGenericCountIndex, Smi::FromInt(value));
+  }
+}
+
+
+int TypeFeedbackVector::Slots() {
+  if (length() == 0) return 0;
+  return Max(0, first_ic_slot_index() - kReservedIndexCount);
+}
+
+
+int TypeFeedbackVector::ICSlots() {
+  if (length() == 0) return 0;
+  return length() - first_ic_slot_index();
+}
+
+
+int TypeFeedbackVector::GetIndex(FeedbackVectorSlot slot) {
+  return kReservedIndexCount + slot.ToInt();
+}
+
+
+int TypeFeedbackVector::GetIndex(FeedbackVectorICSlot slot) {
+  int first_ic_slot = first_ic_slot_index();
+  DCHECK(slot.ToInt() < ICSlots());
+  return first_ic_slot + slot.ToInt();
+}
+
+
+FeedbackVectorSlot TypeFeedbackVector::ToSlot(int index) {
+  DCHECK(index >= kReservedIndexCount && index < first_ic_slot_index());
+  return FeedbackVectorSlot(index - kReservedIndexCount);
+}
+
+
+FeedbackVectorICSlot TypeFeedbackVector::ToICSlot(int index) {
+  DCHECK(index >= first_ic_slot_index() && index < length());
+  return FeedbackVectorICSlot(index - first_ic_slot_index());
+}
+
+
+Object* TypeFeedbackVector::Get(FeedbackVectorSlot slot) {
+  return get(GetIndex(slot));
+}
+
+
+void TypeFeedbackVector::Set(FeedbackVectorSlot slot, Object* value,
+                             WriteBarrierMode mode) {
+  set(GetIndex(slot), value, mode);
+}
+
+
+Object* TypeFeedbackVector::Get(FeedbackVectorICSlot slot) {
+  return get(GetIndex(slot));
+}
+
+
+void TypeFeedbackVector::Set(FeedbackVectorICSlot slot, Object* value,
+                             WriteBarrierMode mode) {
+  set(GetIndex(slot), value, mode);
+}

[mvstanton, 2014/10/20 07:57:44]

I've moved these out of -inl.h back to .h. They don't pollute the namespace,
dealing only with smis, slots, constants, etc.

+
+
 Handle<Object> TypeFeedbackVector::UninitializedSentinel(Isolate* isolate) {
   return isolate->factory()->uninitialized_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::MegamorphicSentinel(Isolate* isolate) {
   return isolate->factory()->megamorphic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::PremonomorphicSentinel(Isolate* isolate) {
-  return isolate->factory()->megamorphic_symbol();
+  return isolate->factory()->premonomorphic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::GenericSentinel(Isolate* isolate) {
   return isolate->factory()->generic_symbol();
 }
 
 
 Handle<Object> TypeFeedbackVector::MonomorphicArraySentinel(
     Isolate* isolate, ElementsKind elements_kind) {
   return Handle<Object>(Smi::FromInt(static_cast<int>(elements_kind)), isolate);
 }
 
 
 Object* TypeFeedbackVector::RawUninitializedSentinel(Heap* heap) {
   return heap->uninitialized_symbol();
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_TYPE_FEEDBACK_VECTOR_INL_H_