vector-based ICs did not update type feedback counts correctly.

src/compiler.cc

Index: src/compiler.cc
diff --git a/src/compiler.cc b/src/compiler.cc
index ce3badb0f380727a0eef5c5f57412e2bce9c0097..deb2857fb36f91993b50923f71773ebc3c0fe197 100644
--- a/src/compiler.cc
+++ b/src/compiler.cc
@@ -283,12 +283,13 @@ void CompilationInfo::PrepareForCompilation(Scope* scope) {
   DCHECK(scope_ == NULL);
   scope_ = scope;
 
-  int length = function()->slot_count();
   if (feedback_vector_.is_null()) {
     // Allocate the feedback vector too.
-    feedback_vector_ = isolate()->factory()->NewTypeFeedbackVector(length);
+    feedback_vector_ = isolate()->factory()->NewTypeFeedbackVector(
+        function()->slot_count(), function()->ic_slot_count());
   }
-  DCHECK(feedback_vector_->length() == length);
+  DCHECK(feedback_vector_->Slots() == function()->slot_count() &&
+         feedback_vector_->ICSlots() == function()->ic_slot_count());
 }