vector-based ICs did not update type feedback counts correctly.

src/liveedit.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 #include "src/v8.h"
 
 #include "src/liveedit.h"
 
 #include "src/code-stubs.h"
@@ skipping 587 matching lines @@
 }
 
 
 static int GetArrayLength(Handle<JSArray> array) {
   Object* length = array->length();
   CHECK(length->IsSmi());
   return Smi::cast(length)->value();
 }
 
 
-void FunctionInfoWrapper::SetInitialProperties(Handle<String> name,
-                                               int start_position,
-                                               int end_position,
-                                               int param_num,
-                                               int literal_count,
-                                               int slot_count,
-                                               int parent_index) {
+void FunctionInfoWrapper::SetInitialProperties(
+    Handle<String> name, int start_position, int end_position, int param_num,
+    int literal_count, int slot_count, int ic_slot_count, int parent_index) {
   HandleScope scope(isolate());
   this->SetField(kFunctionNameOffset_, name);
   this->SetSmiValueField(kStartPositionOffset_, start_position);
   this->SetSmiValueField(kEndPositionOffset_, end_position);
   this->SetSmiValueField(kParamNumOffset_, param_num);
   this->SetSmiValueField(kLiteralNumOffset_, literal_count);
   this->SetSmiValueField(kSlotNumOffset_, slot_count);
+  this->SetSmiValueField(kICSlotNumOffset_, ic_slot_count);
   this->SetSmiValueField(kParentIndexOffset_, parent_index);
 }
 
 
 void FunctionInfoWrapper::SetFunctionCode(Handle<Code> function_code,
                                           Handle<HeapObject> code_scope_info) {
   Handle<JSValue> code_wrapper = WrapInJSValue(function_code);
   this->SetField(kCodeOffset_, code_wrapper);
 
   Handle<JSValue> scope_wrapper = WrapInJSValue(code_scope_info);
@@ skipping 19 matching lines @@
 
 Handle<TypeFeedbackVector> FunctionInfoWrapper::GetFeedbackVector() {
   Handle<Object> element = this->GetField(kSharedFunctionInfoOffset_);
   Handle<TypeFeedbackVector> result;
   if (element->IsJSValue()) {
     Handle<JSValue> value_wrapper = Handle<JSValue>::cast(element);
     Handle<Object> raw_result = UnwrapJSValue(value_wrapper);
     Handle<SharedFunctionInfo> shared =
         Handle<SharedFunctionInfo>::cast(raw_result);
     result = Handle<TypeFeedbackVector>(shared->feedback_vector(), isolate());
-    CHECK_EQ(result->length(), GetSlotCount());
+    CHECK_EQ(result->Slots(), GetSlotCount());
+    CHECK_EQ(result->ICSlots(), GetICSlotCount());
   } else {
     // Scripts may never have a SharedFunctionInfo created, so
     // create a type feedback vector here.
     int slot_count = GetSlotCount();
-    result = isolate()->factory()->NewTypeFeedbackVector(slot_count);
+    int ic_slot_count = GetICSlotCount();
+    result =
+        isolate()->factory()->NewTypeFeedbackVector(slot_count, ic_slot_count);
   }
   return result;
 }
 
 
 Handle<Object> FunctionInfoWrapper::GetCodeScopeInfo() {
   Handle<Object> element = this->GetField(kCodeScopeInfoOffset_);
   return UnwrapJSValue(Handle<JSValue>::cast(element));
 }
 
@@ skipping 22 matching lines @@
  public:
   explicit FunctionInfoListener(Isolate* isolate) {
     current_parent_index_ = -1;
     len_ = 0;
     result_ = isolate->factory()->NewJSArray(10);
   }
 
   void FunctionStarted(FunctionLiteral* fun) {
     HandleScope scope(isolate());
     FunctionInfoWrapper info = FunctionInfoWrapper::Create(isolate());
-    info.SetInitialProperties(fun->name(), fun->start_position(),
-                              fun->end_position(), fun->parameter_count(),
-                              fun->materialized_literal_count(),
-                              fun->slot_count(),
-                              current_parent_index_);
+    info.SetInitialProperties(
+        fun->name(), fun->start_position(), fun->end_position(),
+        fun->parameter_count(), fun->materialized_literal_count(),
+        fun->slot_count(), fun->ic_slot_count(), current_parent_index_);
     current_parent_index_ = len_;
     SetElementSloppy(result_, len_, info.GetJSArray());
     len_++;
   }
 
   void FunctionDone() {
     HandleScope scope(isolate());
     FunctionInfoWrapper info =
         FunctionInfoWrapper::cast(
             *Object::GetElement(
@@ skipping 1354 matching lines @@
 void LiveEditFunctionTracker::RecordRootFunctionInfo(Handle<Code> code) {
   isolate_->active_function_info_listener()->FunctionCode(code);
 }
 
 
 bool LiveEditFunctionTracker::IsActive(Isolate* isolate) {
   return isolate->active_function_info_listener() != NULL;
 }
 
 } }  // namespace v8::internal