vector-based ICs did not update type feedback counts correctly.

src/liveedit.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_LIVEEDIT_H_
 #define V8_LIVEEDIT_H_
 
 
 
 // Live Edit feature implementation.
@@ skipping 262 matching lines @@
 
 // Represents some function compilation details. This structure will be used
 // from JavaScript. It contains Code object, which is kept wrapped
 // into a BlindReference for sanitizing reasons.
 class FunctionInfoWrapper : public JSArrayBasedStruct<FunctionInfoWrapper> {
  public:
   explicit FunctionInfoWrapper(Handle<JSArray> array)
       : JSArrayBasedStruct<FunctionInfoWrapper>(array) {
   }
 
-  void SetInitialProperties(Handle<String> name,
-                            int start_position,
-                            int end_position,
-                            int param_num,
-                            int literal_count,
-                            int slot_count,
+  void SetInitialProperties(Handle<String> name, int start_position,
+                            int end_position, int param_num, int literal_count,
+                            int slot_count, int ic_slot_count,
                             int parent_index);
 
   void SetFunctionCode(Handle<Code> function_code,
                        Handle<HeapObject> code_scope_info);
 
   void SetFunctionScopeInfo(Handle<Object> scope_info_array) {
     this->SetField(kFunctionScopeInfoOffset_, scope_info_array);
   }
 
   void SetSharedFunctionInfo(Handle<SharedFunctionInfo> info);
@@ skipping 15 matching lines @@
   int GetStartPosition() {
     return this->GetSmiValueField(kStartPositionOffset_);
   }
 
   int GetEndPosition() { return this->GetSmiValueField(kEndPositionOffset_); }
 
   int GetSlotCount() {
     return this->GetSmiValueField(kSlotNumOffset_);
   }
 
+  int GetICSlotCount() { return this->GetSmiValueField(kICSlotNumOffset_); }
+
  private:
   static const int kFunctionNameOffset_ = 0;
   static const int kStartPositionOffset_ = 1;
   static const int kEndPositionOffset_ = 2;
   static const int kParamNumOffset_ = 3;
   static const int kCodeOffset_ = 4;
   static const int kCodeScopeInfoOffset_ = 5;
   static const int kFunctionScopeInfoOffset_ = 6;
   static const int kParentIndexOffset_ = 7;
   static const int kSharedFunctionInfoOffset_ = 8;
   static const int kLiteralNumOffset_ = 9;
   static const int kSlotNumOffset_ = 10;
-  static const int kSize_ = 11;
+  static const int kICSlotNumOffset_ = 11;
+  static const int kSize_ = 12;
 
   friend class JSArrayBasedStruct<FunctionInfoWrapper>;
 };
 
 
 // Wraps SharedFunctionInfo along with some of its fields for passing it
 // back to JavaScript. SharedFunctionInfo object itself is additionally
 // wrapped into BlindReference for sanitizing reasons.
 class SharedInfoWrapper : public JSArrayBasedStruct<SharedInfoWrapper> {
  public:
@@ skipping 24 matching lines @@
   static const int kEndPositionOffset_ = 2;
   static const int kSharedInfoOffset_ = 3;
   static const int kSize_ = 4;
 
   friend class JSArrayBasedStruct<SharedInfoWrapper>;
 };
 
 } }  // namespace v8::internal
 
 #endif /* V*_LIVEEDIT_H_ */