vector-based ICs did not update type feedback counts correctly.

src/type-feedback-vector.h

Index: src/type-feedback-vector.h
diff --git a/src/type-feedback-vector.h b/src/type-feedback-vector.h
index b6fadba73ea0623ea62ee852f15eda9af3394207..591d6a0458b63ae376aeacda9196bd5b0e98f63c 100644
--- a/src/type-feedback-vector.h
+++ b/src/type-feedback-vector.h
@@ -14,6 +14,15 @@
 namespace v8 {
 namespace internal {
 
+// The shape of the TypeFeedbackVector is an array with:
+// 0: first_ic_slot_index (-1 if no ic slots present)
+// 1: ics_with_types
+// 2: ics_with_generic_info
+// 3: first feedback slot
+// ...
+// [<first_ic_slot_index>: feedback slot]
+// ...to length() - 1
+//
 class TypeFeedbackVector : public FixedArray {
  public:
   // Casting.
@@ -22,9 +31,51 @@ class TypeFeedbackVector : public FixedArray {
     return reinterpret_cast<TypeFeedbackVector*>(obj);
   }
 
+  static const int kReservedIndexCount = 3;
+  static const int kFirstICSlotIndex = 0;
+  static const int kWithTypesIndex = 1;
+  static const int kGenericCountIndex = 2;
+
+  inline int first_ic_slot_index() {
+    DCHECK(length() >= kReservedIndexCount);
+    return Smi::cast(get(kFirstICSlotIndex))->value();
+  }
+  inline int ic_with_type_info_count();
+  inline void change_ic_with_type_info_count(int delta);
+
+  inline int ic_generic_count();
+  inline void change_ic_generic_count(int delta);
+
+  inline int Slots();
+  inline int ICSlots();
+
+  // Conversion from a slot or ic slot to an integer index to the underlying
+  // array.
+  inline int GetIndex(FeedbackVectorSlot slot);
+  inline int GetIndex(FeedbackVectorICSlot slot);
+
+  // Conversion from an integer index to either a slot or an ic slot. The caller
+  // should know what kind she expects.
+  inline FeedbackVectorSlot ToSlot(int index);
+  inline FeedbackVectorICSlot ToICSlot(int index);
+
+  inline Object* Get(FeedbackVectorSlot slot);
+  inline void Set(FeedbackVectorSlot slot, Object* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline Object* Get(FeedbackVectorICSlot slot);
+  inline void Set(FeedbackVectorICSlot slot, Object* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  static Handle<TypeFeedbackVector> Allocate(Isolate* isolate, int slot_count,
+                                             int ic_slot_count);
+
   static Handle<TypeFeedbackVector> Copy(Isolate* isolate,
                                          Handle<TypeFeedbackVector> vector);
 
+  // Clears vector slots, and leaves vector ic slots alone.
+  void ClearSlots(SharedFunctionInfo* shared);
+
   // The object that indicates an uninitialized cache.
   static inline Handle<Object> UninitializedSentinel(Isolate* isolate);