vector-based ICs did not update type feedback counts correctly.

src/arm64/full-codegen-arm64.cc

Index: src/arm64/full-codegen-arm64.cc
diff --git a/src/arm64/full-codegen-arm64.cc b/src/arm64/full-codegen-arm64.cc
index eba9ad9872918b8cf064ff68cff053413e3f5d37..9d487a5583970c0527e2af04bd694e58683cdbda 100644
--- a/src/arm64/full-codegen-arm64.cc
+++ b/src/arm64/full-codegen-arm64.cc
@@ -1181,7 +1181,8 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
 
   __ LoadObject(x1, FeedbackVector());
   __ Mov(x10, Operand(TypeFeedbackVector::MegamorphicSentinel(isolate())));
-  __ Str(x10, FieldMemOperand(x1, FixedArray::OffsetOfElementAt(slot.ToInt())));
+  int vector_index = FeedbackVector()->GetIndex(slot);
+  __ Str(x10, FieldMemOperand(x1, FixedArray::OffsetOfElementAt(vector_index)));
 
   __ Mov(x1, Smi::FromInt(1));  // Smi indicates slow check.
   __ Peek(x10, 0);  // Get enumerated object.
@@ -2559,9 +2560,7 @@ void FullCodeGenerator::EmitCall(Call* expr, CallICState::CallType call_type) {
       isolate(), arg_count, call_type);
   __ Mov(x3, SmiFromSlot(expr->CallFeedbackSlot()));
   __ Peek(x1, (arg_count + 1) * kXRegSize);
-  // Don't assign a type feedback id to the IC, since type feedback is provided
-  // by the vector above.
-  CallIC(ic);
+  CallIC(ic, TypeFeedbackId(expr->CallFeedbackSlot().ToInt()));
 
   RecordJSReturnSite(expr);
   // Restore context register.