Put the type feedback vector in the unoptimized JavaScript frame.

src/ia32/macro-assembler-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
@@ skipping 3269 matching lines @@
   bool neg = (mag.multiplier & (static_cast<uint32_t>(1) << 31)) != 0;
   if (divisor > 0 && neg) add(edx, dividend);
   if (divisor < 0 && !neg && mag.multiplier > 0) sub(edx, dividend);
   if (mag.shift > 0) sar(edx, mag.shift);
   mov(eax, dividend);
   shr(eax, 31);
   add(edx, eax);
 }
 
 
+void MacroAssembler::OSRDropVectorFromStack(int unoptimized_slot_count,
+                                            Register scratch0,
+                                            Register scratch1) {
+  if (unoptimized_slot_count > 0) {
+    Label loop_start;
+    lea(scratch0,
+        Operand(ebp, JavaScriptFrameConstants::kFeedbackVectorOffset));
+    bind(&loop_start);
+    mov(scratch1, Operand(scratch0, -1 * kPointerSize));
+    mov(Operand(scratch0, 0), scratch1);
+    sub(scratch0, Immediate(kPointerSize));
+    cmp(scratch0, esp);
+    j(greater, &loop_start);
+  }
+  add(esp, Immediate(kPointerSize));
+}
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32