Super Constructor Calls need to use a vector slot, not an ic slot.

src/type-feedback-vector.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPE_FEEDBACK_VECTOR_H_
 #define V8_TYPE_FEEDBACK_VECTOR_H_
 
 #include <vector>
 
 #include "src/checks.h"
@@ skipping 102 matching lines @@
   }
 
   int ICSlots() const {
     if (length() == 0) return 0;
     return length() - first_ic_slot_index();
   }
 
   // Conversion from a slot or ic slot to an integer index to the underlying
   // array.
   int GetIndex(FeedbackVectorSlot slot) const {
+    DCHECK(slot.ToInt() < first_ic_slot_index());
     return kReservedIndexCount + ic_metadata_length() + slot.ToInt();
   }
 
   int GetIndex(FeedbackVectorICSlot slot) const {
     int first_ic_slot = first_ic_slot_index();
     DCHECK(slot.ToInt() < ICSlots());
     return first_ic_slot + slot.ToInt();
   }
 
   // Conversion from an integer index to either a slot or an ic slot. The caller
@@ skipping 225 matching lines @@
   int ExtractMaps(MapHandleList* maps) const OVERRIDE;
   MaybeHandle<Code> FindHandlerForMap(Handle<Map> map) const OVERRIDE;
   virtual bool FindHandlers(CodeHandleList* code_list,
                             int length = -1) const OVERRIDE;
   Name* FindFirstName() const OVERRIDE;
 };
 }
 }  // namespace v8::internal
 
 #endif  // V8_TRANSITIONS_H_