Put the type feedback vector in the unoptimized JavaScript frame.

src/compiler/ia32/code-generator-ia32.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/code-generator.h"
 
 #include "src/compiler/code-generator-impl.h"
 #include "src/compiler/gap-resolver.h"
 #include "src/compiler/node-matchers.h"
 #include "src/ia32/assembler-ia32.h"
@@ skipping 1025 matching lines @@
   if (info()->is_osr()) {
     // TurboFan OSR-compiled functions cannot be entered directly.
     __ Abort(kShouldNotDirectlyEnterOsrFunction);
 
     // Unoptimized code jumps directly to this entrypoint while the unoptimized
     // frame is still on the stack. Optimized code uses OSR values directly from
     // the unoptimized frame. Thus, all that needs to be done is to allocate the
     // remaining stack slots.
     if (FLAG_code_comments) __ RecordComment("-- OSR entrypoint --");
     osr_pc_offset_ = __ pc_offset();
-    DCHECK(stack_slots >= frame()->GetOsrStackSlotCount());
-    stack_slots -= frame()->GetOsrStackSlotCount();
+    int osr_stack_slot_count = frame()->GetOsrStackSlotCount();
+    DCHECK(stack_slots >= osr_stack_slot_count);
+    stack_slots -= osr_stack_slot_count;
+
+    // Full-code javascript functions have a type feedback vector in the frame.
+    // Shift any locals down one slot, and adjust the stack pointer.
+    __ OSRDropVectorFromStack(osr_stack_slot_count, ebx, eax);
   }
 
   if (stack_slots > 0) {
     // Allocate the stack slots used by this frame.
     __ sub(esp, Immediate(stack_slots * kPointerSize));
   }
 }
 
 
 void CodeGenerator::AssembleReturn() {
@@ skipping 212 matching lines @@
     }
   }
   MarkLazyDeoptSite();
 }
 
 #undef __
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8