vector-based ICs did not update type feedback counts correctly.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 3eedfe92faf08b10e71b512049509a7e197ceb26..32aa02df587352381a58fca25012349368432344 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -10384,7 +10384,16 @@ void Code::ClearInlineCaches(Code::Kind* kind) {
     Code* target(Code::GetCodeFromTargetAddress(info->target_address()));
     if (target->is_inline_cache_stub()) {
       if (kind == NULL || *kind == target->kind()) {
-        IC::Clear(this->GetIsolate(), info->pc(),
+        Object* feedback_info =
+            target->kind() == FUNCTION ? type_feedback_info() : NULL;

[Jakob Kummerow, 2014/10/14 15:27:20]

I think you're confused here (or is it a bad merge?). Per the check above,
|target| is an inline cache stub here, never a FUNCTION.

[mvstanton, 2014/10/16 10:54:14]

Yes, this is hilarious and sad. Sorry 'bout that!

+        TypeFeedbackVector* vector =
+            feedback_info->IsTypeFeedbackInfo()

[Jakob Kummerow, 2014/10/14 15:27:20]

feedback_info is NULL here!

[mvstanton, 2014/10/16 10:54:14]

The logic was revisited.

+                ? TypeFeedbackInfo::cast(feedback_info)->feedback_vector()
+                : NULL;
+        FeedbackVectorICSlot slot =
+            FeedbackVectorICSlot(static_cast<unsigned>(info->data()));
+
+        IC::Clear(this->GetIsolate(), info->pc(), vector, slot,
                   info->host()->constant_pool());
       }
     }
@@ -10393,27 +10402,7 @@ void Code::ClearInlineCaches(Code::Kind* kind) {
 
 
 void SharedFunctionInfo::ClearTypeFeedbackInfo() {
-  TypeFeedbackVector* vector = feedback_vector();
-  Heap* heap = GetHeap();
-  int length = vector->length();
-
-  for (int i = 0; i < length; i++) {
-    Object* obj = vector->get(i);
-    if (obj->IsHeapObject()) {
-      InstanceType instance_type =
-          HeapObject::cast(obj)->map()->instance_type();
-      switch (instance_type) {
-        case ALLOCATION_SITE_TYPE:
-          // AllocationSites are not cleared because they do not store
-          // information that leaks.
-          break;
-          // Fall through...
-        default:
-          vector->set(i, TypeFeedbackVector::RawUninitializedSentinel(heap),
-                      SKIP_WRITE_BARRIER);
-      }
-    }
-  }
+  feedback_vector()->ClearSlots();
 }