vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector.cc

Index: src/type-feedback-vector.cc
diff --git a/src/type-feedback-vector.cc b/src/type-feedback-vector.cc
index a3fe0707c7d578fbbbcf204dc51a68694308b271..03ba7576236189e3e6d3f3032e9a928992cd8d3b 100644
--- a/src/type-feedback-vector.cc
+++ b/src/type-feedback-vector.cc
@@ -11,6 +11,36 @@ namespace v8 {
 namespace internal {
 
 // static
+Handle<TypeFeedbackVector> TypeFeedbackVector::Allocate(Isolate* isolate,
+                                                        int slot_count,
+                                                        int ic_slot_count) {
+  int length = slot_count + ic_slot_count + kReservedIndexCount;
+  if (length == kReservedIndexCount) {
+    return Handle<TypeFeedbackVector>::cast(
+        isolate->factory()->empty_fixed_array());
+  }
+
+  Handle<FixedArray> array = isolate->factory()->NewFixedArray(length, TENURED);
+  if (ic_slot_count > 0) {
+    array->set(kFirstICSlotIndex,
+               Smi::FromInt(slot_count + kReservedIndexCount));
+  } else {
+    array->set(kFirstICSlotIndex, Smi::FromInt(-1));
+  }
+  array->set(kWithTypesIndex, Smi::FromInt(0));
+  array->set(kGenericCountIndex, Smi::FromInt(0));
+
+  // Ensure we can skip the write barrier
+  Handle<Object> uninitialized_sentinel = UninitializedSentinel(isolate);
+  DCHECK_EQ(isolate->heap()->uninitialized_symbol(), *uninitialized_sentinel);
+  for (int i = kReservedIndexCount; i < length; i++) {
+    array->set(i, *uninitialized_sentinel, SKIP_WRITE_BARRIER);
+  }
+  return Handle<TypeFeedbackVector>::cast(array);
+}
+
+
+// static
 Handle<TypeFeedbackVector> TypeFeedbackVector::Copy(
     Isolate* isolate, Handle<TypeFeedbackVector> vector) {
   Handle<TypeFeedbackVector> result;
@@ -18,5 +48,29 @@ Handle<TypeFeedbackVector> TypeFeedbackVector::Copy(
       isolate->factory()->CopyFixedArray(Handle<FixedArray>::cast(vector)));
   return result;
 }
+
+
+void TypeFeedbackVector::ClearSlots() {
+  int slots = Slots();
+  Heap* heap = GetIsolate()->heap();
+  for (int i = 0; i < slots; i++) {
+    Object* obj = get(kReservedIndexCount + i);
+    if (obj->IsHeapObject()) {
+      InstanceType instance_type =
+          HeapObject::cast(obj)->map()->instance_type();
+      switch (instance_type) {
+        case ALLOCATION_SITE_TYPE:
+          // AllocationSites are not cleared because they do not store
+          // information that leaks.
+          break;
+        // Fall through...
+        default:
+          set(kReservedIndexCount + i,
+              TypeFeedbackVector::RawUninitializedSentinel(heap),
+              SKIP_WRITE_BARRIER);
+      }
+    }
+  }
+}
 }
 }  // namespace v8::internal