Put the type feedback vector in the unoptimized JavaScript frame.

src/deoptimizer.h

Index: src/deoptimizer.h
diff --git a/src/deoptimizer.h b/src/deoptimizer.h
index 471a05d9b0a0f8cdbd9647c01697133c137ba7a9..000031d90575f552c698ce267b4805a43223a556 100644
--- a/src/deoptimizer.h
+++ b/src/deoptimizer.h
@@ -409,7 +409,11 @@ class Deoptimizer : public Malloced {
   void DoTranslateObjectAndSkip(TranslationIterator* iterator);
 
   unsigned ComputeInputFrameSize() const;
-  unsigned ComputeFixedSize(JSFunction* function) const;
+
+  // Unoptimized javascript frames have an additional word for the type
+  // feedback vector.
+  unsigned ComputeFixedSize(JSFunction* function,
+                            bool unoptimized_frame = false) const;
 
   unsigned ComputeIncomingArgumentSize(JSFunction* function) const;
   unsigned ComputeOutgoingArgumentSize() const;
@@ -951,7 +955,7 @@ class SlotRefValueBuilder BASE_EMBEDDED {
 
   static Address SlotAddress(JavaScriptFrame* frame, int slot_index) {
     if (slot_index >= 0) {
-      const int offset = JavaScriptFrameConstants::kLocal0Offset;
+      const int offset = JavaScriptFrameConstants::kLocal0OffsetOptimized;
       return frame->fp() + offset - (slot_index * kPointerSize);
     } else {
       const int offset = JavaScriptFrameConstants::kLastParameterOffset;