Put the type feedback vector in the unoptimized JavaScript frame.

src/isolate.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 
 #include <fstream>  // NOLINT(readability/streams)
 #include <sstream>
 
 #include "src/v8.h"
@@ skipping 1047 matching lines @@
     // For JavaScript frames we perform a range lookup in the handler table.
     if (frame->is_java_script() && catchable_by_js) {
       JavaScriptFrame* js_frame = static_cast<JavaScriptFrame*>(frame);
       int stack_slots = 0;  // Will contain operand stack depth of handler.
       offset = js_frame->LookupExceptionHandlerInTable(&stack_slots);
       if (offset < 0) continue;
 
       // Compute the stack pointer from the frame pointer. This ensures that
       // operand stack slots are dropped for nested statements. Also restore
       // correct context for the handler which is pushed within the try-block.
-      Address return_sp = frame->fp() -
-                          StandardFrameConstants::kFixedFrameSizeFromFp -
-                          stack_slots * kPointerSize;
+      Address return_sp =
+          frame->fp() -
+          JavaScriptFrameConstants::kUnoptimizedFixedFrameSizeFromFp -
+          stack_slots * kPointerSize;
       STATIC_ASSERT(TryBlockConstant::kElementCount == 1);
       context = Context::cast(Memory::Object_at(return_sp - kPointerSize));
 
       // Gather information from the frame.
       code = frame->LookupCode();
       handler_sp = return_sp;
       handler_fp = frame->fp();
       break;
     }
   }
@@ skipping 1574 matching lines @@
   if (prev_ && prev_->Intercept(flag)) return true;
   // Then check whether this scope intercepts.
   if ((flag & intercept_mask_)) {
     intercepted_flags_ |= flag;
     return true;
   }
   return false;
 }
 
 } }  // namespace v8::internal