vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
+#include "src/ic/ic-state.h"
 #include "src/objects.h"
 #include "src/type-feedback-vector-inl.h"
 
 namespace v8 {
 namespace internal {
 
 // static
+Handle<TypeFeedbackVector> TypeFeedbackVector::Allocate(Isolate* isolate,
+                                                        int slot_count,
+                                                        int ic_slot_count) {
+  int length = slot_count + ic_slot_count + kReservedIndexCount;
+  if (length == kReservedIndexCount) {
+    return Handle<TypeFeedbackVector>::cast(
+        isolate->factory()->empty_fixed_array());
+  }
+
+  Handle<FixedArray> array = isolate->factory()->NewFixedArray(length, TENURED);
+  if (ic_slot_count > 0) {
+    array->set(kFirstICSlotIndex,
+               Smi::FromInt(slot_count + kReservedIndexCount));
+  } else {
+    array->set(kFirstICSlotIndex, Smi::FromInt(length));
+  }
+  array->set(kWithTypesIndex, Smi::FromInt(0));
+  array->set(kGenericCountIndex, Smi::FromInt(0));
+
+  // Ensure we can skip the write barrier
+  Handle<Object> uninitialized_sentinel = UninitializedSentinel(isolate);
+  DCHECK_EQ(isolate->heap()->uninitialized_symbol(), *uninitialized_sentinel);
+  for (int i = kReservedIndexCount; i < length; i++) {
+    array->set(i, *uninitialized_sentinel, SKIP_WRITE_BARRIER);
+  }
+  return Handle<TypeFeedbackVector>::cast(array);
+}
+
+
+// static
 Handle<TypeFeedbackVector> TypeFeedbackVector::Copy(
     Isolate* isolate, Handle<TypeFeedbackVector> vector) {
   Handle<TypeFeedbackVector> result;
   result = Handle<TypeFeedbackVector>::cast(
       isolate->factory()->CopyFixedArray(Handle<FixedArray>::cast(vector)));
   return result;
 }
+
+
+void TypeFeedbackVector::ClearSlots(SharedFunctionInfo* shared) {
+  int slots = Slots();
+  Isolate* isolate = GetIsolate();
+  Object* uninitialized_sentinel =
+      TypeFeedbackVector::RawUninitializedSentinel(isolate->heap());
+
+  for (int i = 0; i < slots; i++) {
+    FeedbackVectorSlot slot(i);
+    Object* obj = Get(slot);
+    if (obj->IsHeapObject()) {
+      InstanceType instance_type =
+          HeapObject::cast(obj)->map()->instance_type();
+      switch (instance_type) {
+        case ALLOCATION_SITE_TYPE:
+          // AllocationSites are not cleared because they do not store
+          // information that leaks.
+          break;
+        // Fall through...

[Jakob Kummerow, 2014/10/20 10:29:43]

Uhm, what? Either "break;" or "// Fall through.", but not both!

(I'd just use an if/else, but if you like your switch statement, you can keep
it.)

[mvstanton, 2014/10/20 11:09:22]

You are right, it's unwieldy...changing to if()...

+        default:
+          Set(slot, uninitialized_sentinel, SKIP_WRITE_BARRIER);
+      }
+    }
+  }
+
+  // Now clear vector-based ICs. They are all CallICs.

[Jakob Kummerow, 2014/10/20 10:29:43]

Whoa. The comment in the header said "leaves vector ic slots alone".

Is there a DCHECK we could guard the "They're all CallICs" invariant with?

[mvstanton, 2014/10/20 11:09:22]

Nice catch, I'll fix that outdated comment in the header...it's an artifact of
the first try at this, where vector IC clearing was done during RelocInfo
marking.

Hmm, the DCHECK won't work because there isn't currently a "metadata" section in
the TypeFeedbackVector that can be checked to verify that each IC slot is a
CallIC. But my *next* CL already has such a structure, and it's usage will be
checked. The loop below will end up casing the handling of each IC slot on
something like 

Code::KIND kind(FeedbackVectorICSlot slot);

+  // Try and pass the containing code (the "host")
+  slots = ICSlots();
+  Code* host = shared->code();
+  for (int i = 0; i < slots; i++) {
+    FeedbackVectorICSlot slot(i);
+    Object* obj = Get(slot);
+    if (obj != uninitialized_sentinel) {
+      ICUtility::Clear(isolate, Code::CALL_IC, host, this, slot);
+    }
+  }
+}
 }
 }  // namespace v8::internal