vector-based ICs did not update type feedback counts correctly.

src/ic/ic-inl.h

Index: src/ic/ic-inl.h
diff --git a/src/ic/ic-inl.h b/src/ic/ic-inl.h
index e10fb456ce5cc6a8bdc75216a99a59749537b884..bf76e86bbb8f530ce913dba722e2934f8dcf371d 100644
--- a/src/ic/ic-inl.h
+++ b/src/ic/ic-inl.h
@@ -208,21 +208,34 @@ Handle<Map> IC::GetICCacheHolder(HeapType* type, Isolate* isolate,
 }
 
 
-IC::State CallIC::FeedbackToState(Handle<TypeFeedbackVector> vector,
-                                  Handle<Smi> slot) const {
+// static
+IC::State CallIC::FeedbackToState(Isolate* isolate, TypeFeedbackVector* vector,
+                                  FeedbackVectorICSlot slot) {
   IC::State state = UNINITIALIZED;
-  Object* feedback = vector->get(slot->value());
+  Object* feedback = vector->Get(slot);
 
-  if (feedback == *TypeFeedbackVector::MegamorphicSentinel(isolate())) {
+  if (feedback == *TypeFeedbackVector::MegamorphicSentinel(isolate)) {
     state = GENERIC;
   } else if (feedback->IsAllocationSite() || feedback->IsJSFunction()) {
     state = MONOMORPHIC;
   } else {
-    CHECK(feedback == *TypeFeedbackVector::UninitializedSentinel(isolate()));
+    CHECK(feedback == *TypeFeedbackVector::UninitializedSentinel(isolate));
   }
 
   return state;
 }
+
+
+IC::State CallIC::FeedbackToState(Handle<TypeFeedbackVector> vector,
+                                  FeedbackVectorICSlot slot) const {
+  return FeedbackToState(isolate(), *vector, slot);
+}
+
+
+void CallIC::OnTypeFeedbackChanged(Handle<TypeFeedbackVector> vector,
+                                   State old_state, State new_state) {
+  OnTypeFeedbackChanged(isolate(), address(), *vector, old_state, new_state);
+}
 }
 }  // namespace v8::internal