vector-based ICs did not update type feedback counts correctly.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index 8df53af0df9a63126066a1469b73b217e1b36537..25e715c0fc65433cc58ade86e0b8505ba9f8842d 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -61,7 +61,8 @@ class Factory FINAL {
   Handle<AccessorPair> NewAccessorPair();
 
   // Create an empty TypeFeedbackInfo.
-  Handle<TypeFeedbackInfo> NewTypeFeedbackInfo();
+  Handle<TypeFeedbackInfo> NewTypeFeedbackInfo(
+      Handle<TypeFeedbackVector> vector);
 
   // Finds the internalized copy for string in the string table.
   // If not found, a new string is added to the table and returned.
@@ -618,7 +619,8 @@ class Factory FINAL {
                                                    MaybeHandle<Code> code);
 
   // Allocate a new type feedback vector
-  Handle<TypeFeedbackVector> NewTypeFeedbackVector(int slot_count);
+  Handle<TypeFeedbackVector> NewTypeFeedbackVector(int slot_count,
+                                                   int ic_slot_count);
 
   // Allocates a new JSMessageObject object.
   Handle<JSMessageObject> NewJSMessageObject(