vector-based ICs did not update type feedback counts correctly.

src/ic/ic.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_IC_H_
 #define V8_IC_H_
 
 #include "src/ic/ic-state.h"
 #include "src/macro-assembler.h"
 
@@ skipping 68 matching lines @@
   static void RegisterWeakMapDependency(Handle<Code> stub);
 
   // This function is called when a weak map in the stub is dying,
   // invalidates the stub by setting maps in it to undefined.
   static void InvalidateMaps(Code* stub);
 
   // Clear the inline cache to initial state.
   static void Clear(Isolate* isolate, Address address,
                     ConstantPoolArray* constant_pool);
 
+  // Clear the vector-based inline cache to initial state.
+  static void Clear(Isolate* isolate, Code::Kind kind, Code* host,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot);
+
 #ifdef DEBUG
   bool IsLoadStub() const {
     return target()->is_load_stub() || target()->is_keyed_load_stub();
   }
 
   bool IsStoreStub() const {
     return target()->is_store_stub() || target()->is_keyed_store_stub();
   }
 
   bool IsCallStub() const { return target()->is_call_stub(); }
@@ skipping 188 matching lines @@
   Address address_;
   IC::UtilityId id_;
 };
 
 
 class CallIC : public IC {
  public:
   explicit CallIC(Isolate* isolate) : IC(EXTRA_CALL_FRAME, isolate) {}
 
   void PatchMegamorphic(Handle<Object> function,
-                        Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                        Handle<TypeFeedbackVector> vector,
+                        FeedbackVectorICSlot slot);
 
   void HandleMiss(Handle<Object> receiver, Handle<Object> function,
-                  Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                  Handle<TypeFeedbackVector> vector, FeedbackVectorICSlot slot);
 
   // Returns true if a custom handler was installed.
   bool DoCustomHandler(Handle<Object> receiver, Handle<Object> function,
-                       Handle<TypeFeedbackVector> vector, Handle<Smi> slot,
-                       const CallICState& state);
+                       Handle<TypeFeedbackVector> vector,
+                       FeedbackVectorICSlot slot, const CallICState& state);
 
   // Code generator routines.
   static Handle<Code> initialize_stub(Isolate* isolate, int argc,
                                       CallICState::CallType call_type);
 
-  static void Clear(Isolate* isolate, Address address, Code* target,
-                    ConstantPoolArray* constant_pool);
+  static void Clear(Isolate* isolate, Code* host, TypeFeedbackVector* vector,
+                    FeedbackVectorICSlot slot);
 
  private:
-  inline IC::State FeedbackToState(Handle<TypeFeedbackVector> vector,
-                                   Handle<Smi> slot) const;
+  static inline IC::State FeedbackToState(Isolate* isolate,
+                                          TypeFeedbackVector* vector,
+                                          FeedbackVectorICSlot slot);
+
+  inline Code* get_host();
+
+  // As a vector-based IC, type feedback must be updated differently.
+  static void OnTypeFeedbackChanged(Isolate* isolate, Code* host,
+                                    TypeFeedbackVector* vector, State old_state,
+                                    State new_state);
 };
 
 
 class LoadIC : public IC {
  public:
   static ExtraICState ComputeExtraICState(ContextualMode contextual_mode) {
     return LoadICState(contextual_mode).GetExtraICState();
   }
 
   ContextualMode contextual_mode() const {
@@ skipping 375 matching lines @@
 
 // Support functions for interceptor handlers.
 DECLARE_RUNTIME_FUNCTION(LoadPropertyWithInterceptorOnly);
 DECLARE_RUNTIME_FUNCTION(LoadPropertyWithInterceptor);
 DECLARE_RUNTIME_FUNCTION(LoadElementWithInterceptor);
 DECLARE_RUNTIME_FUNCTION(StorePropertyWithInterceptor);
 }
 }  // namespace v8::internal
 
 #endif  // V8_IC_H_