Put the type feedback vector in the unoptimized JavaScript frame.

src/ia32/macro-assembler-ia32.cc

Index: src/ia32/macro-assembler-ia32.cc
diff --git a/src/ia32/macro-assembler-ia32.cc b/src/ia32/macro-assembler-ia32.cc
index f35d16a3231fc259c00c69921d9c53a7cf13b567..4cfd354b4edda482ee84ff5a1141ae86d6886fa8 100644
--- a/src/ia32/macro-assembler-ia32.cc
+++ b/src/ia32/macro-assembler-ia32.cc
@@ -3227,6 +3227,21 @@ void MacroAssembler::TruncatingDiv(Register dividend, int32_t divisor) {
 }
 
 
+void MacroAssembler::AdaptUnoptimizedFrameForOsrEntry(
+    int unoptimized_slot_count, Register scratch0, Register scratch1) {
+  if (unoptimized_slot_count > 0) {
+    Label loop_start;
+    lea(scratch0,
+        Operand(ebp, JavaScriptFrameConstants::kFeedbackVectorOffset));
+    bind(&loop_start);
+    mov(scratch1, Operand(scratch0, -1 * kPointerSize));
+    mov(Operand(scratch0, 0), scratch1);
+    sub(scratch0, Immediate(kPointerSize));
+    cmp(scratch0, esp);
+    j(greater, &loop_start);
+  }
+  add(esp, Immediate(kPointerSize));
+}
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32