Put the type feedback vector in the unoptimized JavaScript frame.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index a8de06ee5850f82949b63ba1146865aba7cd3536..a854d20ad6a706a54c6a77fed56a081004d3a417 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -124,7 +124,8 @@ int Deoptimizer::ConvertJSFrameIndexToFrameIndex(int jsframe_index) {
   int frame_index = 0;
   while (jsframe_index >= 0) {
     FrameDescription* frame = output_[frame_index];
-    if (frame->GetFrameType() == StackFrame::JAVA_SCRIPT) {
+    if (frame->GetFrameType() == StackFrame::JAVA_SCRIPT ||
+        frame->GetFrameType() == StackFrame::OPTIMIZED) {
       jsframe_index--;
     }
     frame_index++;
@@ -600,9 +601,8 @@ Deoptimizer::Deoptimizer(Isolate* isolate,
   }
 #endif
 
-  StackFrame::Type frame_type = function == NULL
-      ? StackFrame::STUB
-      : StackFrame::JAVA_SCRIPT;
+  StackFrame::Type frame_type =
+      function == NULL ? StackFrame::STUB : StackFrame::OPTIMIZED;
   trace_scope_ = TraceEnabledFor(type, frame_type) ?
       new CodeTracer::Scope(isolate->GetCodeTracer()) : NULL;
 #ifdef DEBUG
@@ -887,7 +887,7 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
 
   // The 'fixed' part of the frame consists of the incoming parameters and
   // the part described by JavaScriptFrameConstants.
-  unsigned fixed_frame_size = ComputeFixedSize(function);
+  unsigned fixed_frame_size = ComputeFixedSize(function, true);
   unsigned input_frame_size = input_->GetFrameSize();
   unsigned output_frame_size = height_in_bytes + fixed_frame_size;
 
@@ -917,10 +917,10 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
     // 2 = context and function in the frame.
     // If the optimized frame had alignment padding, adjust the frame pointer
     // to point to the new position of the old frame pointer after padding
-    // is removed. Subtract 2 * kPointerSize for the context and function slots.
+    // is removed. Subtract the fixed frame size.
     top_address = input_->GetRegister(fp_reg.code()) -
-        StandardFrameConstants::kFixedFrameSizeFromFp -
-        height_in_bytes + has_alignment_padding_ * kPointerSize;
+                  JavaScriptFrameConstants::kUnoptimizedFixedFrameSizeFromFp -
+                  height_in_bytes + has_alignment_padding_ * kPointerSize;
   } else {
     top_address = output_[frame_index - 1]->GetTop() - output_frame_size;
   }
@@ -1054,6 +1054,18 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
            top_address + output_offset, output_offset, value);
   }
 
+  // The type feedback vector must be retrieved from the function, as it's
+  // not available in the input frame.
+  output_offset -= kPointerSize;
+  TypeFeedbackVector* vector = function->shared()->feedback_vector();
+  value = reinterpret_cast<intptr_t>(vector);
+  output_frame->SetFrameSlot(output_offset, value);
+  if (trace_scope_ != NULL) {
+    PrintF(trace_scope_->file(),
+           "    0x%08" V8PRIxPTR ": [top + %d] <- 0x%08" V8PRIxPTR "; vector\n",
+           top_address + output_offset, output_offset, value);
+  }
+
   // Translate the rest of the frame.
   for (unsigned i = 0; i < height; ++i) {
     output_offset -= kPointerSize;
@@ -2710,11 +2722,14 @@ unsigned Deoptimizer::ComputeInputFrameSize() const {
 }
 
 
-unsigned Deoptimizer::ComputeFixedSize(JSFunction* function) const {
+unsigned Deoptimizer::ComputeFixedSize(JSFunction* function,
+                                       bool unoptimized_frame) const {
   // The fixed part of the frame consists of the return address, frame
   // pointer, function, context, and all the incoming arguments.
   return ComputeIncomingArgumentSize(function) +
-      StandardFrameConstants::kFixedFrameSize;
+         (unoptimized_frame
+              ? JavaScriptFrameConstants::kUnoptimizedFixedFrameSize
+              : StandardFrameConstants::kFixedFrameSize);
 }
 
 
@@ -2840,8 +2855,12 @@ FrameDescription::FrameDescription(uint32_t frame_size,
 
 
 int FrameDescription::ComputeFixedSize() {
-  return StandardFrameConstants::kFixedFrameSize +
-      (ComputeParametersCount() + 1) * kPointerSize;
+  // Full-code javascript frames have a type feedback vector.
+  const int fixed_size =
+      type_ == StackFrame::JAVA_SCRIPT
+          ? JavaScriptFrameConstants::kUnoptimizedFixedFrameSize
+          : StandardFrameConstants::kFixedFrameSize;
+  return fixed_size + (ComputeParametersCount() + 1) * kPointerSize;
 }
 
 
@@ -2862,6 +2881,7 @@ unsigned FrameDescription::GetOffsetFromSlotIndex(int slot_index) {
 
 int FrameDescription::ComputeParametersCount() {
   switch (type_) {
+    case StackFrame::OPTIMIZED:
     case StackFrame::JAVA_SCRIPT:
       return function_->shared()->internal_formal_parameter_count();
     case StackFrame::ARGUMENTS_ADAPTOR: {
@@ -2888,14 +2908,14 @@ Object* FrameDescription::GetParameter(int index) {
 
 
 unsigned FrameDescription::GetExpressionCount() {
-  CHECK_EQ(StackFrame::JAVA_SCRIPT, type_);
+  CHECK(type_ == StackFrame::JAVA_SCRIPT);
   unsigned size = GetFrameSize() - ComputeFixedSize();
   return size / kPointerSize;
 }
 
 
 Object* FrameDescription::GetExpression(int index) {
-  DCHECK_EQ(StackFrame::JAVA_SCRIPT, type_);
+  DCHECK(type_ == StackFrame::JAVA_SCRIPT);
   unsigned offset = GetOffsetFromSlotIndex(index);
   return reinterpret_cast<Object*>(*GetFrameSlotPointer(offset));
 }