vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_FEEDBACK_VECTOR_H_
 #define V8_TYPE_FEEDBACK_VECTOR_H_
 
 #include "src/checks.h"
 #include "src/elements-kind.h"
 #include "src/heap/heap.h"
 #include "src/isolate.h"
 #include "src/objects.h"
 
 namespace v8 {
 namespace internal {
 
+// The shape of the TypeFeedbackVector is an array with:
+// 0: first_ic_slot_index (-1 if no ic slots present)
+// 1: ics_with_types
+// 2: ics_with_generic_info
+// 3: first feedback slot
+// ...
+// [<first_ic_slot_index>: feedback slot]
+// ...to length() - 1
+//
 class TypeFeedbackVector : public FixedArray {
  public:
   // Casting.
   static TypeFeedbackVector* cast(Object* obj) {
     DCHECK(obj->IsTypeFeedbackVector());
     return reinterpret_cast<TypeFeedbackVector*>(obj);
   }
 
+  static const int kReservedIndexCount = 3;
+  static const int kFirstICSlotIndex = 0;
+  static const int kWithTypesIndex = 1;
+  static const int kGenericCountIndex = 2;
+
+  inline int first_ic_slot_index() {
+    DCHECK(length() >= kReservedIndexCount);
+    return Smi::cast(get(kFirstICSlotIndex))->value();
+  }
+  inline int ic_with_type_info_count();
+  inline void change_ic_with_type_info_count(int delta);
+
+  inline int ic_generic_count();
+  inline void change_ic_generic_count(int delta);
+
+  inline int Slots();
+  inline int ICSlots();
+
+  // Conversion from a slot or ic slot to an integer index to the underlying
+  // array.
+  inline int GetIndex(FeedbackVectorSlot slot);
+  inline int GetIndex(FeedbackVectorICSlot slot);
+
+  // Conversion from an integer index to either a slot or an ic slot. The caller
+  // should know what kind she expects.
+  inline FeedbackVectorSlot ToSlot(int index);
+  inline FeedbackVectorICSlot ToICSlot(int index);
+
+  inline Object* Get(FeedbackVectorSlot slot);
+  inline void Set(FeedbackVectorSlot slot, Object* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline Object* Get(FeedbackVectorICSlot slot);
+  inline void Set(FeedbackVectorICSlot slot, Object* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  static Handle<TypeFeedbackVector> Allocate(Isolate* isolate, int slot_count,
+                                             int ic_slot_count);
+
   static Handle<TypeFeedbackVector> Copy(Isolate* isolate,
                                          Handle<TypeFeedbackVector> vector);
 
+  // Clears vector slots, and leaves vector ic slots alone.
+  void ClearSlots(SharedFunctionInfo* shared);
+
   // The object that indicates an uninitialized cache.
   static inline Handle<Object> UninitializedSentinel(Isolate* isolate);
 
   // The object that indicates a megamorphic state.
   static inline Handle<Object> MegamorphicSentinel(Isolate* isolate);
 
   // The object that indicates a premonomorphic state.
   static inline Handle<Object> PremonomorphicSentinel(Isolate* isolate);
 
   // The object that indicates a generic state.
   static inline Handle<Object> GenericSentinel(Isolate* isolate);
 
   // The object that indicates a monomorphic state of Array with
   // ElementsKind
   static inline Handle<Object> MonomorphicArraySentinel(
       Isolate* isolate, ElementsKind elements_kind);
 
   // A raw version of the uninitialized sentinel that's safe to read during
   // garbage collection (e.g., for patching the cache).
   static inline Object* RawUninitializedSentinel(Heap* heap);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(TypeFeedbackVector);
 };
 }
 }  // namespace v8::internal
 
 #endif  // V8_TRANSITIONS_H_