Put the type feedback vector in the unoptimized JavaScript frame.

src/deoptimizer.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_DEOPTIMIZER_H_
 #define V8_DEOPTIMIZER_H_
 
 #include "src/v8.h"
 
 #include "src/allocation.h"
@@ skipping 379 matching lines @@
   // Translate value, store the result into the given frame slot.
   void DoTranslateCommand(TranslationIterator* iterator,
                           int frame_index,
                           unsigned output_offset);
 
   // Translate object, do not store the result anywhere (but do update
   // the deferred materialization array).
   void DoTranslateObjectAndSkip(TranslationIterator* iterator);
 
   unsigned ComputeInputFrameSize() const;
-  unsigned ComputeFixedSize(JSFunction* function) const;
+
+  // Unoptimized javascript frames have an additional word for the type
+  // feedback vector.
+  unsigned ComputeFixedSize(JSFunction* function,
+                            bool unoptimized_frame = false) const;
 
   unsigned ComputeIncomingArgumentSize(JSFunction* function) const;
   unsigned ComputeOutgoingArgumentSize() const;
 
   Object* ComputeLiteral(int index) const;
 
   void AddObjectStart(intptr_t slot_address, int argc, bool is_arguments);
   void AddObjectDuplication(intptr_t slot, int object_index);
   void AddObjectTaggedValue(intptr_t value);
   void AddObjectDoubleValue(double value);
@@ skipping 521 matching lines @@
   static SlotRef ComputeSlotForNextArgument(
       Translation::Opcode opcode,
       TranslationIterator* iterator,
       DeoptimizationInputData* data,
       JavaScriptFrame* frame);
 
   Handle<Object> GetPreviouslyMaterialized(Isolate* isolate, int length);
 
   static Address SlotAddress(JavaScriptFrame* frame, int slot_index) {
     if (slot_index >= 0) {
-      const int offset = JavaScriptFrameConstants::kLocal0Offset;
+      const int offset = JavaScriptFrameConstants::kLocal0OffsetOptimized;
       return frame->fp() + offset - (slot_index * kPointerSize);
     } else {
       const int offset = JavaScriptFrameConstants::kLastParameterOffset;
       return frame->fp() + offset - ((slot_index + 1) * kPointerSize);
     }
   }
 
   Handle<Object> GetDeferredObject(Isolate* isolate);
 };
 
@@ skipping 92 matching lines @@
   Object** parameters_;
   Object** expression_stack_;
   int source_position_;
 
   friend class Deoptimizer;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_DEOPTIMIZER_H_