vector-based ICs did not update type feedback counts correctly.

src/compiler/ast-graph-builder.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_AST_GRAPH_BUILDER_H_
 #define V8_COMPILER_AST_GRAPH_BUILDER_H_
 
 #include "src/v8.h"
 
 #include "src/ast.h"
@@ skipping 127 matching lines @@
   CompilationInfo* info() const { return info_; }
   inline StrictMode strict_mode() const;
   JSGraph* jsgraph() { return jsgraph_; }
   JSOperatorBuilder* javascript() { return jsgraph_->javascript(); }
   ZoneList<Handle<Object> >* globals() { return &globals_; }
 
   // Current scope during visitation.
   inline Scope* current_scope() const;
 
   // Named and keyed loads require a VectorSlotPair for successful lowering.
-  VectorSlotPair CreateVectorSlotPair(FeedbackVectorSlot slot) const;
+  VectorSlotPair CreateVectorSlotPair(FeedbackVectorICSlot slot) const;
 
   // Process arguments to a call by popping {arity} elements off the operand
   // stack and build a call node using the given call operator.
   Node* ProcessArguments(const Operator* op, int arity);
 
   // Visit statements.
   void VisitIfNotNull(Statement* stmt);
 
   // Visit expressions.
   void VisitForTest(Expression* expr);
@@ skipping 273 matching lines @@
 };
 
 Scope* AstGraphBuilder::current_scope() const {
   return execution_context_->scope();
 }
 }
 }
 }  // namespace v8::internal::compiler
 
 #endif  // V8_COMPILER_AST_GRAPH_BUILDER_H_