vector-based ICs did not update type feedback counts correctly.

src/utils.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_UTILS_H_
 #define V8_UTILS_H_
 
 #include <limits.h>
 #include <stdlib.h>
 #include <string.h>
@@ skipping 933 matching lines @@
   static TypeFeedbackId None() { return TypeFeedbackId(kNoneId); }
   bool IsNone() const { return id_ == kNoneId; }
 
  private:
   static const int kNoneId = -1;
 
   int id_;
 };
 
 
-class FeedbackVectorSlot {
+template <int dummy_parameter>
+class VectorSlot {
  public:
-  explicit FeedbackVectorSlot(int id) : id_(id) {}
+  explicit VectorSlot(int id) : id_(id) {}
   int ToInt() const { return id_; }
 
-  static FeedbackVectorSlot Invalid() {
-    return FeedbackVectorSlot(kInvalidSlot);
-  }
+  static VectorSlot Invalid() { return VectorSlot(kInvalidSlot); }
   bool IsInvalid() const { return id_ == kInvalidSlot; }
 
-  FeedbackVectorSlot next() const {
+  VectorSlot next() const {
     DCHECK(id_ != kInvalidSlot);
-    return FeedbackVectorSlot(id_ + 1);
+    return VectorSlot(id_ + 1);
   }
 
+  bool operator==(const VectorSlot& other) const { return id_ == other.id_; }
+
  private:
   static const int kInvalidSlot = -1;
 
   int id_;
 };
 
 
+typedef VectorSlot<0> FeedbackVectorSlot;
+typedef VectorSlot<1> FeedbackVectorICSlot;
+
+
 class BailoutId {
  public:
   explicit BailoutId(int id) : id_(id) { }
   int ToInt() const { return id_; }
 
   static BailoutId None() { return BailoutId(kNoneId); }
   static BailoutId FunctionEntry() { return BailoutId(kFunctionEntryId); }
   static BailoutId Declarations() { return BailoutId(kDeclarationsId); }
   static BailoutId FirstUsable() { return BailoutId(kFirstUsableId); }
   static BailoutId StubEntry() { return BailoutId(kStubEntryId); }
@@ skipping 498 matching lines @@
   // Takes the address of the limit variable in order to find out where
   // the top of stack is right now.
   uintptr_t limit = reinterpret_cast<uintptr_t>(&limit);
   return limit;
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_UTILS_H_