Put the type feedback vector in the unoptimized JavaScript frame.

src/x64/lithium-codegen-x64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 236 matching lines @@
   // Generate the OSR entry prologue at the first unknown OSR value, or if there
   // are none, at the OSR entrypoint instruction.
   if (osr_pc_offset_ >= 0) return;
 
   osr_pc_offset_ = masm()->pc_offset();
 
   // Adjust the frame size, subsuming the unoptimized frame into the
   // optimized frame.
   int slots = GetStackSlotCount() - graph()->osr()->UnoptimizedFrameSlots();
   DCHECK(slots >= 0);
+  __ OSRDropVectorFromStack(graph()->osr()->UnoptimizedFrameSlots(), rbx, rax);
   __ subp(rsp, Immediate(slots * kPointerSize));
 }
 
 
 void LCodeGen::GenerateBodyInstructionPre(LInstruction* instr) {
   if (instr->IsCall()) {
     EnsureSpaceForLazyDeopt(Deoptimizer::patch_size());
   }
   if (!instr->IsLazyBailout() && !instr->IsGap()) {
     safepoints_.BumpLastLazySafepointIndex();
@@ skipping 5664 matching lines @@
   CallRuntime(Runtime::kPushBlockContext, 2, instr);
   RecordSafepoint(Safepoint::kNoLazyDeopt);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64