vector-based ICs did not update type feedback counts correctly.

src/compiler/js-operator.h

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_JS_OPERATOR_H_
 #define V8_COMPILER_JS_OPERATOR_H_
 
 #include "src/runtime/runtime.h"
 #include "src/unique.h"
 
@@ skipping 80 matching lines @@
 
 size_t hash_value(ContextAccess const&);
 
 std::ostream& operator<<(std::ostream&, ContextAccess const&);
 
 ContextAccess const& ContextAccessOf(Operator const*);
 
 
 class VectorSlotPair {
  public:
-  VectorSlotPair(Handle<TypeFeedbackVector> vector, FeedbackVectorSlot slot)
+  VectorSlotPair(Handle<TypeFeedbackVector> vector, FeedbackVectorICSlot slot)
       : vector_(vector), slot_(slot) {}
 
   Handle<TypeFeedbackVector> vector() const { return vector_; }
-  FeedbackVectorSlot slot() const { return slot_; }
+  FeedbackVectorICSlot slot() const { return slot_; }
 
  private:
   const Handle<TypeFeedbackVector> vector_;
-  const FeedbackVectorSlot slot_;
+  const FeedbackVectorICSlot slot_;
 };
 
 
 bool operator==(VectorSlotPair const& lhs, VectorSlotPair const& rhs);
 
 
 // Defines the property being loaded from an object by a named load. This is
 // used as a parameter by JSLoadNamed operators.
 class LoadNamedParameters FINAL {
  public:
@@ skipping 144 matching lines @@
 
   const JSOperatorBuilderImpl& impl_;
   Zone* const zone_;
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_JS_OPERATOR_H_