vector-based ICs did not update type feedback counts correctly.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index 1a658d17cbae4ea4082b87f04ede4b012ee6569f..e9972cc13a8a96613a3bc4102745bb43c503045f 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -622,7 +622,8 @@ class Factory FINAL {
                                                    MaybeHandle<Code> code);
 
   // Allocate a new type feedback vector
-  Handle<TypeFeedbackVector> NewTypeFeedbackVector(int slot_count);
+  Handle<TypeFeedbackVector> NewTypeFeedbackVector(int slot_count,
+                                                   int ic_slot_count);
 
   // Allocates a new JSMessageObject object.
   Handle<JSMessageObject> NewJSMessageObject(