vector-based ICs did not update type feedback counts correctly.

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index 60ea691d916ff071dfec04459bdccd7c34c7b0fd..c2321124bf20b100aacac1ceb17625aeca6975ae 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -157,9 +157,11 @@ Handle<AccessorPair> Factory::NewAccessorPair() {
 }
 
 
-Handle<TypeFeedbackInfo> Factory::NewTypeFeedbackInfo() {
+Handle<TypeFeedbackInfo> Factory::NewTypeFeedbackInfo(
+    Handle<TypeFeedbackVector> vector) {
   Handle<TypeFeedbackInfo> info =
       Handle<TypeFeedbackInfo>::cast(NewStruct(TYPE_FEEDBACK_INFO_TYPE));
+  info->set_feedback_vector(*vector);
   info->initialize_storage();
   return info;
 }
@@ -1940,20 +1942,9 @@ void Factory::BecomeJSFunction(Handle<JSProxy> proxy) {
 }
 
 
-Handle<TypeFeedbackVector> Factory::NewTypeFeedbackVector(int slot_count) {
-  // Ensure we can skip the write barrier
-  DCHECK_EQ(isolate()->heap()->uninitialized_symbol(),
-            *TypeFeedbackVector::UninitializedSentinel(isolate()));
-
-  if (slot_count == 0) {
-    return Handle<TypeFeedbackVector>::cast(empty_fixed_array());
-  }
-
-  CALL_HEAP_FUNCTION(isolate(),
-                     isolate()->heap()->AllocateFixedArrayWithFiller(
-                         slot_count, TENURED,
-                         *TypeFeedbackVector::UninitializedSentinel(isolate())),
-                     TypeFeedbackVector);
+Handle<TypeFeedbackVector> Factory::NewTypeFeedbackVector(int slot_count,
+                                                          int ic_slot_count) {
+  return TypeFeedbackVector::Allocate(isolate(), slot_count, ic_slot_count);
 }
 
 
@@ -2028,7 +2019,7 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
   share->set_script(*undefined_value(), SKIP_WRITE_BARRIER);
   share->set_debug_info(*undefined_value(), SKIP_WRITE_BARRIER);
   share->set_inferred_name(*empty_string(), SKIP_WRITE_BARRIER);
-  Handle<TypeFeedbackVector> feedback_vector = NewTypeFeedbackVector(0);
+  Handle<TypeFeedbackVector> feedback_vector = NewTypeFeedbackVector(0, 0);
   share->set_feedback_vector(*feedback_vector, SKIP_WRITE_BARRIER);
   share->set_profiler_ticks(0);
   share->set_ast_node_count(0);