vector-based ICs did not update type feedback counts correctly.

src/full-codegen.h

Index: src/full-codegen.h
diff --git a/src/full-codegen.h b/src/full-codegen.h
index 57283bbaae7783d92206c67a76ea37c1101eb07f..3ed16c355037a3ea11f177366c46f5a518b14ff2 100644
--- a/src/full-codegen.h
+++ b/src/full-codegen.h
@@ -429,12 +429,20 @@ class FullCodeGenerator: public AstVisitor {
 
   // Feedback slot support. The feedback vector will be cleared during gc and
   // collected by the type-feedback oracle.
-  Handle<FixedArray> FeedbackVector() {
+  Handle<TypeFeedbackVector> FeedbackVector() const {
     return info_->feedback_vector();
   }
   void EnsureSlotContainsAllocationSite(FeedbackVectorSlot slot);
+  void EnsureSlotContainsAllocationSite(FeedbackVectorICSlot slot);
+
+  // Returns a smi for the index into the FixedArray that backs the feedback
+  // vector
   Smi* SmiFromSlot(FeedbackVectorSlot slot) const {
-    return Smi::FromInt(slot.ToInt());
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
+  }
+
+  Smi* SmiFromSlot(FeedbackVectorICSlot slot) const {
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
   }
 
   // Record a call's return site offset, used to rebuild the frame if the
@@ -667,7 +675,8 @@ class FullCodeGenerator: public AstVisitor {
 
   void Generate();
   void PopulateDeoptimizationData(Handle<Code> code);
-  void PopulateTypeFeedbackInfo(Handle<Code> code);
+  void PopulateTypeFeedbackInfo(Handle<Code> code,
+                                Handle<TypeFeedbackVector> vector);
 
   Handle<FixedArray> handler_table() { return handler_table_; }