vector-based ICs did not update type feedback counts correctly.

src/ic/ic.h

Index: src/ic/ic.h
diff --git a/src/ic/ic.h b/src/ic/ic.h
index 15479371cb6f80e217309bd801f222add71b0637..25081edbfb15633c87aea79d85b1bf5f97f7c0ac 100644
--- a/src/ic/ic.h
+++ b/src/ic/ic.h
@@ -84,6 +84,7 @@ class IC {
 
   // Clear the inline cache to initial state.
   static void Clear(Isolate* isolate, Address address,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
 #ifdef DEBUG
@@ -294,26 +295,39 @@ class CallIC : public IC {
   explicit CallIC(Isolate* isolate) : IC(EXTRA_CALL_FRAME, isolate) {}
 
   void PatchMegamorphic(Handle<Object> function,
-                        Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                        Handle<TypeFeedbackVector> vector,
+                        FeedbackVectorICSlot slot);
 
   void HandleMiss(Handle<Object> receiver, Handle<Object> function,
-                  Handle<TypeFeedbackVector> vector, Handle<Smi> slot);
+                  Handle<TypeFeedbackVector> vector, FeedbackVectorICSlot slot);
 
   // Returns true if a custom handler was installed.
   bool DoCustomHandler(Handle<Object> receiver, Handle<Object> function,
-                       Handle<TypeFeedbackVector> vector, Handle<Smi> slot,
-                       const CallICState& state);
+                       Handle<TypeFeedbackVector> vector,
+                       FeedbackVectorICSlot slot, const CallICState& state);
 
   // Code generator routines.
   static Handle<Code> initialize_stub(Isolate* isolate, int argc,
                                       CallICState::CallType call_type);
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
  private:
+  static inline IC::State FeedbackToState(Isolate* isolate,
+                                          TypeFeedbackVector* vector,
+                                          FeedbackVectorICSlot slot);
+
   inline IC::State FeedbackToState(Handle<TypeFeedbackVector> vector,
-                                   Handle<Smi> slot) const;
+                                   FeedbackVectorICSlot slot) const;
+
+  // As a vector-based IC, type feedback must be updated differently.
+  static void OnTypeFeedbackChanged(Isolate* isolate, Address address,
+                                    TypeFeedbackVector* vector, State old_state,
+                                    State new_state);
+  inline void OnTypeFeedbackChanged(Handle<TypeFeedbackVector> vector,
+                                    State old_state, State new_state);
 };
 
 
@@ -389,6 +403,7 @@ class LoadIC : public IC {
   Handle<Code> SimpleFieldLoad(FieldIndex index);
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
   friend class IC;
@@ -440,6 +455,7 @@ class KeyedLoadIC : public LoadIC {
   }
 
   static void Clear(Isolate* isolate, Address address, Code* target,
+                    TypeFeedbackVector* vector, FeedbackVectorICSlot slot,
                     ConstantPoolArray* constant_pool);
 
   friend class IC;