Put the type feedback vector in the unoptimized JavaScript frame.

src/ia32/lithium-codegen-ia32.cc

Index: src/ia32/lithium-codegen-ia32.cc
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
index f0cd7b0008aedcc985eaf1a8bb224a3374f8cc9b..31362f9d49522dce21e14366a54a3903671409e5 100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -322,20 +322,23 @@ void LCodeGen::GenerateOsrPrologue() {
     // Move state of dynamic frame alignment into edx.
   __ Move(edx, Immediate(kNoAlignmentPadding));
 
+  Label remove_vector_finished;
+  int unoptimized_slots = graph()->osr()->UnoptimizedFrameSlots();
   if (support_aligned_spilled_doubles_ && dynamic_frame_alignment_) {
     Label do_not_pad, align_loop;
     // Align ebp + 4 to a multiple of 2 * kPointerSize.
     __ test(ebp, Immediate(kPointerSize));
     __ j(zero, &do_not_pad, Label::kNear);
-    __ push(Immediate(0));
+
     __ mov(ebx, esp);
+    __ add(Operand(ebx), Immediate(kPointerSize * unoptimized_slots));
     __ mov(edx, Immediate(kAlignmentPaddingPushed));
 
-    // Move all parts of the frame over one word. The frame consists of:
-    // unoptimized frame slots, alignment state, context, frame pointer, return
-    // address, receiver, and the arguments.
-    __ mov(ecx, Immediate(scope()->num_parameters() +
-           5 + graph()->osr()->UnoptimizedFrameSlots()));
+    // Move the receiver, parameters and fixed part of the frame above the type
+    // feedback vector over one word, stomping on the vector.
+    __ mov(ecx,
+           Immediate(1 + scope()->num_parameters() +
+                     StandardFrameConstants::kFixedFrameSize / kPointerSize));
 
     __ bind(&align_loop);
     __ mov(eax, Operand(ebx, 1 * kPointerSize));
@@ -345,9 +348,16 @@ void LCodeGen::GenerateOsrPrologue() {
     __ j(not_zero, &align_loop, Label::kNear);
     __ mov(Operand(ebx, 0), Immediate(kAlignmentZapValue));
     __ sub(Operand(ebp), Immediate(kPointerSize));
+    __ jmp(&remove_vector_finished);
     __ bind(&do_not_pad);
+    // We have to move locals over one.
+    __ AdaptUnoptimizedFrameForOsrEntry(unoptimized_slots, ebx, eax);
+  } else {
+    // Need to copy locals over by one.
+    __ AdaptUnoptimizedFrameForOsrEntry(unoptimized_slots, ebx, eax);
   }
 
+  __ bind(&remove_vector_finished);
   // Save the first local, which is overwritten by the alignment state.
   Operand alignment_loc = MemOperand(ebp, -3 * kPointerSize);
   __ push(alignment_loc);