vector-based ICs did not update type feedback counts correctly.

src/heap/objects-visiting-inl.h

Index: src/heap/objects-visiting-inl.h
diff --git a/src/heap/objects-visiting-inl.h b/src/heap/objects-visiting-inl.h
index d220118368e77d07b973ec92c701061ddf06b6a5..00c2e4caa685ba5ae5e69f685e149c7e3857510a 100644
--- a/src/heap/objects-visiting-inl.h
+++ b/src/heap/objects-visiting-inl.h
@@ -261,12 +261,21 @@ void StaticMarkingVisitor<StaticVisitor>::VisitCodeTarget(Heap* heap,
   // to be serialized.
   if (FLAG_cleanup_code_caches_at_gc && target->is_inline_cache_stub() &&
       (target->ic_state() == MEGAMORPHIC || target->ic_state() == GENERIC ||
-       target->ic_state() == POLYMORPHIC ||
+       target->ic_state() == POLYMORPHIC || target->is_call_stub() ||
        (heap->flush_monomorphic_ics() && !target->is_weak_stub()) ||
        heap->isolate()->serializer_enabled() ||
        target->ic_age() != heap->global_ic_age() ||
        target->is_invalidated_weak_stub())) {
-    ICUtility::Clear(heap->isolate(), rinfo->pc(),
+    TypeFeedbackVector* vector = NULL;
+    FeedbackVectorICSlot slot(FeedbackVectorICSlot::Invalid());
+    if (target->is_call_stub()) {
+      Object* feedback_info = rinfo->host()->type_feedback_info();
+      vector = feedback_info->IsTypeFeedbackInfo()
+                   ? TypeFeedbackInfo::cast(feedback_info)->feedback_vector()
+                   : NULL;
+      slot = FeedbackVectorICSlot(static_cast<unsigned>(rinfo->data()));
+    }
+    ICUtility::Clear(heap->isolate(), rinfo->pc(), vector, slot,
                      rinfo->host()->constant_pool());
     target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   }