The allocation sinking optimization pass creates PhantomNewObject nodes to keep track of the old NewObject nodes, which must be kept as they are used to restore the state of allocations on OSR exit, and thus should be marked NodeMustGenerate. They are currently prevented from being removed by the PutHint for the object's structure, but that is a rather implicit safety net.
Created attachment 251208 [details] The patch
Comment on attachment 251208 [details] The patch Clearing flags on attachment: 251208 Committed r183040: <http://trac.webkit.org/changeset/183040>
All reviewed patches have been landed. Closing bug.
convertToPhantomNewObject() do not properly set the NodeMustGenerate flag.
Created attachment 251262 [details] Fix convertToPhantomNewObject
Comment on attachment 251262 [details] Fix convertToPhantomNewObject Clearing flags on attachment: 251262 Committed r183078: <http://trac.webkit.org/changeset/183078>