Fix dictionary size for type feedback oracle.

R=erik.corry@gmail.com

Review URL: https://chromiumcodereview.appspot.com/9293005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/type-info.cc

@@ -565,8 +565,9 @@ void TypeFeedbackOracle::GetRelocInfos(Handle<Code> code,
 void TypeFeedbackOracle::CreateDictionary(Handle<Code> code,
                                           ZoneList<RelocInfo>* infos) {
   DisableAssertNoAllocation allocation_allowed;
+  int length = infos->length() + code->type_feedback_cells()->CellCount();
   byte* old_start = code->instruction_start();
-  dictionary_ = FACTORY->NewUnseededNumberDictionary(infos->length());
+  dictionary_ = FACTORY->NewUnseededNumberDictionary(length);
   byte* new_start = code->instruction_start();
   RelocateRelocInfos(infos, old_start, new_start);
 }