Put the type feedback vector in the unoptimized JavaScript frame.

src/deoptimizer.h

Index: src/deoptimizer.h
diff --git a/src/deoptimizer.h b/src/deoptimizer.h
index fd65e83dd2683acfb4c2a6f325364189f5fff863..0468268193268c4079be38a1e902c5112467f34e 100644
--- a/src/deoptimizer.h
+++ b/src/deoptimizer.h
@@ -397,7 +397,11 @@ class Deoptimizer : public Malloced {
   void DoTranslateObjectAndSkip(TranslationIterator* iterator);
 
   unsigned ComputeInputFrameSize() const;
-  unsigned ComputeFixedSize(JSFunction* function) const;
+
+  // Unoptimized javascript frames have an additional word for the type
+  // feedback vector.
+  unsigned ComputeFixedSize(JSFunction* function,
+                            bool unoptimized_frame = false) const;
 
   unsigned ComputeIncomingArgumentSize(JSFunction* function) const;
   unsigned ComputeOutgoingArgumentSize() const;
@@ -939,7 +943,7 @@ class SlotRefValueBuilder BASE_EMBEDDED {
 
   static Address SlotAddress(JavaScriptFrame* frame, int slot_index) {
     if (slot_index >= 0) {
-      const int offset = JavaScriptFrameConstants::kLocal0Offset;
+      const int offset = JavaScriptFrameConstants::kLocal0OffsetOptimized;
       return frame->fp() + offset - (slot_index * kPointerSize);
     } else {
       const int offset = JavaScriptFrameConstants::kLastParameterOffset;