vector-based ICs did not update type feedback counts correctly.

src/full-codegen.h

Index: src/full-codegen.h
diff --git a/src/full-codegen.h b/src/full-codegen.h
index 57283bbaae7783d92206c67a76ea37c1101eb07f..078b69be6ad9ab5f04ef4f2815308b7804035e19 100644
--- a/src/full-codegen.h
+++ b/src/full-codegen.h
@@ -429,12 +429,20 @@ class FullCodeGenerator: public AstVisitor {
 
   // Feedback slot support. The feedback vector will be cleared during gc and
   // collected by the type-feedback oracle.
-  Handle<FixedArray> FeedbackVector() {
+  Handle<TypeFeedbackVector> FeedbackVector() const {
     return info_->feedback_vector();
   }
   void EnsureSlotContainsAllocationSite(FeedbackVectorSlot slot);
+  void EnsureSlotContainsAllocationSite(FeedbackVectorICSlot slot);
+
+  // Returns a smi for the index into the FixedArray that backs the feedback
+  // vector
   Smi* SmiFromSlot(FeedbackVectorSlot slot) const {
-    return Smi::FromInt(slot.ToInt());
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
+  }
+
+  Smi* SmiFromSlot(FeedbackVectorICSlot slot) const {
+    return Smi::FromInt(FeedbackVector()->GetIndex(slot));
   }
 
   // Record a call's return site offset, used to rebuild the frame if the